SOC Analyst

SOC Analyst at Xello, remote, 3-6 years experience, salary discussed at interview.

Responsibilities: • Development and refinement of normalization, enrichment, and correlation rules for information security events from various sources; • Implementation of detection mechanisms/rules; • Validation of created detections through simulation of real attacks; • Development, updating, and implementation of incident response scenarios (IR playbooks); • Preparation of automation scenarios; • Investigation and timely escalation of information security incidents; • Documentation of configuration, integrations, and system setup instructions.

Requirements: • Experience in developing correlation and detection rules from scratch for specific threats and TTPs, and testing their effectiveness (analysis of false positives/negatives); • Experience in investigating information security incidents and developing recommendations to prevent them; • Experience in automating internal SIEM and SOAR processes; • Experience with Windows/Linux systems and understanding of main attack vectors; • Knowledge of main attack vectors at the network level and web applications/API level; • Basic scripting skills (bash, PowerShell, Python); • Skills in writing SQL queries, Yara, and Sigma rules; • Understanding of ways to detect main attack vectors and types, attacker tactics and techniques (Cyber Kill Chain, MITRE ATT&CK, TTP, etc.); • Understanding of the OSI model, TCP/IP stack, network protocols such as HTTP/HTTPS, DNS, DHCP, ARP, etc.; • Ability to analyze security event logs, OS logs, network equipment logs, and database logs; • In-depth knowledge of SIEM systems (Wazuh, ELK, etc.) and OWASP.