security operations center (soc) analyst

cFocus Software Incorporated

<div><h1 class="jobSectionHeader">Digital Forensics Engineer Job Description</h1>
Position Title: Digital Forensics Engineer 
Program: SBA Enterprise Cybersecurity Services (ECS)<h2 class="jobSectionHeader">
Position Summary</h2>
The Digital Forensics Engineer supports the Small Business Administration (SBA) Enterprise Cybersecurity Services (ECS) program by providing advanced digital forensics, incident response, cyber investigation, evidence preservation, malware analysis, and e-discovery support services. 
The Digital Forensics Engineer conducts complex forensic examinations involving workstations, servers, cloud platforms, mobile devices, email systems, network traffic, and enterprise applications in support of cybersecurity investigations, incident response activities, insider threat investigations, legal support actions, and enterprise cyber defense operations. The role supports 24x7x365 Security Operations Center (SOC) functions and coordinates closely with federal stakeholders, incident responders, threat hunters, legal teams, privacy personnel, and law enforcement partners.<h2 class="jobSectionHeader">
Essential Duties and Responsibilities</h2><ul><li>
Perform advanced digital forensic analysis and investigations in support of SBA ECS cybersecurity operations requirements.</li><li>
Support Task Areas 3.5.3 and 3.5.3.6 by conducting forensic examinations related to cybersecurity incidents, insider threats, malware infections, unauthorized access, and data exfiltration.</li><li>
Collect, preserve, analyze, and document digital evidence in accordance with federal forensic standards and chain-of-custody procedures.</li><li>
Perform host-based, network-based, cloud-based, and mobile device forensic investigations across enterprise environments.</li><li>
Conduct forensic acquisition and analysis of Windows, Linux, macOS, cloud, virtualized, and hybrid systems.</li><li>
Analyze endpoint telemetry, security logs, network packet captures (PCAP), SIEM data, and forensic artifacts to identify indicators of compromise (IOCs) and adversary activity.</li><li>
Support incident response activities by reconstructing attack timelines, determining root cause, identifying attack vectors, and assessing operational impact.</li><li>
Perform malware analysis and reverse engineering support activities to identify malicious behaviors, persistence mechanisms, and command-and-control communications.</li><li>
Support e-discovery operations including collection, indexing, preservation, processing, and review of electronically stored information (ESI).</li><li>
Conduct forensic examinations supporting legal, Inspector General (IG), Human Resources (HR), insider threat, privacy, and law enforcement investigations.</li><li>
Utilize forensic and cyber defense tools including EnCase, FTK, Velociraptor, Wireshark, Volatility, Splunk, Microsoft Defender, Sentinel, and endpoint detection and response (EDR) platforms.</li><li>
Perform memory analysis, disk analysis, registry analysis, browser artifact analysis, and log correlation activities.</li><li>
Develop forensic reports, technical findings, evidentiary documentation, executive briefings, and remediation recommendations.</li><li>
Maintain detailed forensic documentation, evidence handling procedures, and chain-of-custody records.</li><li>
Support cybersecurity monitoring, detection, containment, eradication, and recovery activities within the SOC environment.</li><li>
Coordinate with SOC analysts, incident responders, threat hunters, engineers, and federal stakeholders during cyber investigations and breach response activities.</li><li>
Support continuous improvement of forensic methodologies, investigative procedures, and cybersecurity operational capabilities.</li><li>
Assist with the development and maintenance of digital forensic playbooks, standard operating procedures (SOPs), and incident handling guidance aligned with NIST SP 800-61 and NIST SP 800-86.</li><li>
Research emerging cyber threats, adversary tactics, techniques, and procedures (TTPs), and evolving forensic technologies.</li><li>
Support federal cybersecurity compliance requirements, reporting activities, and operational readiness initiatives.</li></ul><h2 class="jobSectionHeader">
Minimum Qualifications</h2><ul><li>
Bachelor&rsquo;s degree in Cybersecurity, Computer Science, Digital Forensics, Information Assurance, Information Technology, or related discipline. Relevant experience may substitute for degree requirements.</li><li>
Minimum of 8 years of experience supporting digital forensics, cyber investigations, incident response, cybersecurity operations, or Security Operations Center (SOC) environments.</li><li>
Hands-on experience conducting enterprise-level forensic investigations and evidence analysis.</li><li>
Experience with forensic acquisition and analysis tools including EnCase, FTK, X-Ways, Velociraptor, Volatility, or equivalent technologies.</li><li>
Experience analyzing Windows, Linux, cloud, mobile, and network forensic artifacts.</li><li>
Knowledge of incident response methodologies, MITRE ATT&amp;CK framework, cyber kill chain concepts, and adversary TTP analysis.</li><li>
Experience supporting legal hold, e-discovery, insider threat, and regulatory investigation activities.</li><li>
Experience with SIEM, EDR, IDS/IPS, packet analysis, and security monitoring technologies.</li><li>
Strong understanding of NIST cybersecurity standards including NIST SP 800-61 and NIST SP 800-86.</li><li>
Ability to prepare technical forensic reports and present investigative findings to technical and executive stakeholders.</li><li>
Strong analytical, investigative, communication, and technical documentation skills.</li></ul><h2 class="jobSectionHeader">
Preferred Certifications</h2><ul><li>
GIAC Certified Forensic Analyst (GCFA)</li><li>
GIAC Network Forensic Analyst (GNFA)</li><li>
GIAC Certified Incident Handler (GCIH)</li><li>
EnCase Certified Examiner (EnCE)</li><li>
Certified Computer Examiner (CCE)</li><li>
Certified Ethical Hacker (CEH)</li><li>
CompTIA CySA+</li><li>
CompTIA Security+</li><li>
Certified Information Systems Security Professional (CISSP)</li></ul>
6HY6JyRiD8</div>

SBA - Digital Forensics Engineer

Standard Textile

<div>At Standard Textile, we&rsquo;re dedicated to providing comfort and care across generations. Guided by our values, we focus on solutions that serve our customers, support our associates, and strengthen our communities. Since 1940, we&rsquo;ve remained committed to creating better textiles&mdash;delivered seamlessly by experts who care.
The IT Security Analyst is responsible for defending our manufacturing environment against cyber threats. Core duties include monitoring and triaging security alerts across endpoint, network, identity, and cloud telemetry; investigating and responding to incidents; hardening systems and infrastructure; managing vulnerabilities; and supporting security tooling such as XDR, EDR, email security, and firewalls.
This role reports to and works directly with our IT Security Lead, who will mentor the IT Security Analyst on our tooling, playbooks, and environment. You will work firsthand with AI agents and automation built into our security operations. The ideal candidate has a foundation in security operations, strong fundamentals, and an interest in growing into broader IT cybersecurity work.
Key Responsibilities:<ul><li>
Monitor XDR, EDR, and other security tooling to detect, triage, and investigate suspicious activity across endpoints, network, identity, and cloud environments.</li><li>
Use AI agents and automated workflows to accelerate alert triage, enrichment, and initial investigation.</li><li>
Assist in incident response activities (containment, eradication, recovery, and post-incident review) and maintain the playbooks and runbooks that support them.</li><li>
Participate in threat hunting using known TTPs and threat intelligence and help tune detection logic to reduce false positives.</li><li>
Run the vulnerability management lifecycle (scanning, prioritization, coordination of remediation, and verification).</li><li>
Support identity and access controls (privileged access, conditional access, account reviews).</li><li>
Assist with hardening endpoints, servers, Active Directory, and cloud workloads against common attack techniques (e.g., MITRE ATT&amp;CK).</li></ul>
Collaboration and Communication<ul><li>
Partner with IT infrastructure, application, and operations teams to embed security into systems, projects, and day-to-day operations.</li><li>
Partner with Security Lead to identify high-leverage automation opportunities and help build, evaluate, and tune agentic workflows for the SOC.</li><li>
Communicate security risks, incidents, and mitigation strategies clearly to technical teams, senior management, and, when needed, external partners or incident response retainers.</li></ul>
Qualifications Include:<ul><li>
Bachelor&rsquo;s degree in Cybersecurity, Information System Analytics, Computer Science, or a closely related discipline.</li><li>
1&ndash;3 years of experience in a SOC, IT security, or closely related IT role (internships and co-ops count). Firsthand exposure to incident response, networking, or system administration.</li><li>
Solid fundamentals in cybersecurity, common attacker tradecraft (e.g., MITRE ATT&amp;CK), networking, and Windows/Linux/Active Directory administration. Firsthand exposure to a SIEM, XDR, or EDR platform is a plus.</li><li>
Relevant certifications such as CompTIA Security+, CySA+, Network+, Microsoft SC-200, Cisco CyberOps Associate, Blue Team Level 1 (BTL1), or GIAC GSEC/GCIH are preferred.</li></ul>
Proudly, Standard Textile has earned a title of US Best Managed Company for the fifth year running, an honor awarded by Deloitte Private and The Wall Street Journal, celebrating the exceptional achievements of American private companies and their management teams.
Standard Textile is an Equal Opportunity Employer, including Veterans and Individuals with Disabilities.
Join us!</div>

IT Security Analyst

Asyad Group

Asyad oversees Oman&rsquo;s logistics ecosystem including ports, shipping, and freight services.As a Cyber Security at Asyad Group - this role focuses on detecting, investigating, and responding to cyber threats to protect an organization&rsquo;s systems, data, and critical infrastructure.Job Description:1. Incident Detection &amp; ResponseMonitor security alerts using SIEM toolsInvestigate suspicious activities and cyberattacksPerform incident triage, analysis, and containment2. Threat Hunting &amp; MonitoringProactively search for hidden threats in systemsAnalyze logs (firewalls, endpoints, network traffic)Use tools like:EDR/XDR (e.g., CrowdStrike, SentinelOne)3. Digital Forensics &amp; InvestigationConduct malware analysis and forensic investigationsIdentify root cause of incidentsAssess scope and impact of breaches4. Containment &amp; RecoveryIsolate affected systemsRemove threats and restore operationsDevelop remediation plans5. Documentation &amp; ReportingCreate incident reports and post-mortem analysisRecommend security improvementsMaintain incident logs and compliance records6. CollaborationWork with:SOC (Security Operations Center) teamsIT and network teamsExternal cybersecurity vendors7. Security ImprovementImprove incident response processesDevelop playbooks and automationStay updated on emerging cyber threatsRequirements:Bachelor&rsquo;s degree in IT, Cybersecurity, or related fieldCertifications (preferred):CISSPCEHCompTIA CySA+ / Security+Experience:2&ndash;5 years (junior-mid)5+ years (senior roles)Job Type: Full-timePay: From RO1,500.000 per monthWork Location: In person

Cybersecurity / Incident Response Specialist (Asyad Group)

Henry Ford Health

<div><div>Click the Link below to learn about the Leader
MEET THE LEADER
GENERAL SUMMARY
Reporting to the Information Security Services Manager, the Cyber Security Analyst is an operational role focusing on real time security event monitoring and security incident response. As a Cyber Security Analyst, you will actively manage the continuous protection of systems and information assets by contributing to or leading teams in the execution and implementation of information security defense improvements involving architecture, processes, tools and automation. This includes protecting both cloud and on-premises infrastructures, monitoring events by identifying suspicious activity and conducting incident investigation leading to the remediation of attack. Working with IT members you will carry out in-depth threat intelligence analysis to find the perpetrator, the type of attack, and the data or systems impacted. The Cyber Security Analyst position is a valued member of the Information Privacy &amp; Security Office (IPSO) department and will work closely with other members of the SOC, IPSO (Risk, Privacy, etc.) and IT programs to develop and implement a comprehensive approach to the management of security risks.
<div>EDUCATION/EXPERIENCE REQUIRED:<ul><li>
Bachelor's degree in computer science, information assurance, Information Technology or STEM degree or 3-4+ years equivalent experience (Information Security, IT network).</li><li>
Five (5) years of experience required. CompTIA Security+, preferred.</li></ul>
CERTIFICATIONS:<ul><li>
CEH (Certified Ethical Hacker), preferred. GIAC (Certified Penetration), preferred. CISM (Certified Information Security), preferred. CISSP: (Certified Information Systems Security Professional), preferred.</li></ul>
 </div></div><div><div><div><div><h4 class="jobSectionHeader">Additional Details</h4>
<div>
This posting represents the major duties, responsibilities, and authorities of this job, and is not intended to be a complete list of all tasks and functions. It should be understood, therefore, that incumbents may be asked to perform job-related duties beyond those explicitly described above.</div>
</div>
</div></div><div><div><div><h4 class="jobSectionHeader">Overview</h4>
<div>
Henry Ford Health partners with millions of people on their health journey, across Michigan and around the world. We offer a full continuum of services &ndash; from primary and preventative care to complex and specialty care, health insurance, a full suite of home health offerings, virtual care, pharmacy, eye care and other health care retail. With former Ascension southeast Michigan and Flint region locations now part of our team, Henry Ford&rsquo;s care is available in 13 hospitals and hundreds of ambulatory care locations. Based in Detroit, Henry Ford is one of the nation&rsquo;s most respected academic medical centers and is leading the Future of Health: Detroit, a $3 billion investment anchored by a reimagined Henry Ford academic healthcare campus. Learn more at henryford.com/careers.</div>
</div>
</div></div><div><div><div><h4 class="jobSectionHeader">Benefits</h4><div> 
The health and overall well-being of our team members is our priority. That&rsquo;s why we offer support in the various components of our team&rsquo;s well-being: physical, emotional, social, financial and spiritual. Our Total Rewards program includes competitive health plan options, with three consumer-driven health plans (CDHPs), a PPO plan and an HMO plan. Our team members enjoy a number of additional benefits, ranging from dental and eye care coverage to tuition assistance, family forming benefits, discounts to dozens of businesses and more. Employees classified as contingent status are not eligible for benefits.
</div></div></div></div><div><div><div><h4 class="jobSectionHeader">Equal Employment Opportunity/Affirmative Action Employer</h4>
<div>
 Equal Employment Opportunity / Affirmative Action Employer Henry Ford Health is

 committed to the hiring, advancement and fair treatment of all individuals without regard to

 race, color, creed, religion, age, sex, national origin, disability, veteran status, size, height,

 weight, marital status, family status, gender identity, sexual orientation, and genetic information,

 or any other protected status in accordance with applicable federal and state laws.</div></div></div></div></div></div>

Cybersecurity Analyst- IOT Security

Chromalloy

Chromalloy is a global engineering & solutions company. We are a leading provider of aftermarket parts, repairs, and solutions that safely & reliably extend the life of aircraft engines and gas turbines. We develop, manufacture and repair critical turbine components for a range of engine platforms. Our solutions support the engines running the aerospace, energy and defense industries around the world.
 Video: What We Do
 Why work at Chromalloy?
 Chromalloy employees are proud, passionate problem-solvers who strive to live our values every day. A career with Chromalloy is an opportunity to learn from top industry experts, work with important technologies, and unlock a passion for innovation. Join our team of experts, innovators and problem-solvers delivering world-class solutions for our customers. As a global company, we are committed to creating an inclusive environment where all employees feel represented, heard, and able to bring their best selves to work every day. Be part of something bigger with Chromalloy!
 Our Total Rewards Program is designed to support you today and in the future.
 <ul>
<li>Comprehensive and flexible benefit options starting on day one, including medical, dental, vision, EAP, wellness incentives, and 401(k) with employer matching.</li>
<li>Development & progression opportunities for every employee – regular performance conversations, training and development curriculum, and engineering fellowship programs.</li>
<li>Paid time off, including vacation, sick time, paid holidays, and parental leave—all eligible on your first day of employment!</li>
<li>Competitive pay, including eligibility for quarterly and annual bonuses, depending on role and site.</li>
</ul>
Eligibility for individual benefit plans may vary based on employment status.
 
Job Description
 The Global IT Security Analyst is a critical role responsible for monitoring, detecting, investigating, and responding to cybersecurity threats across our global environment. This is an ideal opportunity for someone motivated by hands-on incident response, cross-functional collaboration, and strengthening the security posture of systems, infrastructure, and end-user computing.
 We are looking for an individual with strong technical depth and the judgment to prioritize and drive incidents to resolution, while clearly communicating impact, status, and next steps to both technical teams and business partners. You will help build repeatable response playbooks and partner with end users to improve security awareness and reduce risk.
 
Primary Accountabilities: 
<ul>
<li>Monitor, triage, and investigate security alerts using SIEM and endpoint detection and response (EDR) tooling; validate severity and scope, and document findings.</li>
<li>Execute and continuously improve incident response processes (prepare, detect, contain, eradicate, recover); develop and maintain playbooks and runbooks for common scenarios (phishing, malware, account compromise, ransomware).</li>
<li>Perform incident investigation and analysis using logs and telemetry (identity, endpoint, network, cloud); conduct basic packet and host analysis as needed to determine root cause and attacker activity.</li>
<li>Coordinate incident response with the SOC/MDR provider and internal teams (IT, Infrastructure, HR, Legal, and business stakeholders); ensure timely escalation and handoffs.</li>
<li>Lead containment and remediation actions (e.g., isolate endpoints, disable accounts, block indicators, reset credentials) and track actions through to closure with clear timelines and ownership.</li>
<li>Drive post-incident reviews (lessons learned) and implement corrective actions to reduce recurrence, improve detection logic, and strengthen controls.</li>
<li>Maintain awareness of the current threat landscape and translate threat intelligence into actionable detections, hardening recommendations, and user guidance.</li>
<li>Support governance and assurance activities including policy/standard reviews, control evidence collection, and third-party risk and audit activities (e.g., ISO 27001, NIST, CIS).</li>
<li>Create and tune detection content (queries, correlation rules, and indicators) to improve signal quality and reduce false positives in security monitoring tools.</li>
<li>Perform basic malware triage and forensic collection as needed (e.g., preserve evidence, analyze artifacts, support deeper analysis by internal teams or vendors).</li>
<li>Engage end users during investigations (e.g., phishing reports, suspicious activity) with clear guidance and empathy; contribute to security awareness initiatives (phishing education, safe computing practices) and incorporate user feedback to improve processes.</li>
</ul>
Qualifications
 
Education and Experience: 
<ul>
<li>BS degree in Computer Science, Engineering or Information Technology or equivalent.</li>
<li>3-5 years of experience in a cybersecurity/SOC/IT security operations role with exposure to incident triage, investigation, and coordinated response.</li>
<li>Working knowledge of security frameworks and control concepts (ISO 27001/27002, NIST 800-53/171, CIS Controls) and how they translate into operational controls.</li>
<li>Experience with common security tooling is preferred (SIEM, EDR, vulnerability scanning, email security, identity platforms; SOAR a plus). Certifications such as Security+, GCIH, GCIA, CEH, SSCP, or equivalent are preferred.</li>
<li>Strong written and verbal communication skills; able to explain risk and response steps to end users and stakeholders, produce incident documentation, and present post-incident findings.</li>
<li>Must be able to travel as needed, sometimes as much as 30%.</li>
</ul>
The salary range for this position reflects a broad spectrum of experience levels. Individual compensation within the range is determined by multiple factors, including relevant experience, education, certifications, job related skills, internal equity, and market conditions. We evaluate each candidate individually to ensure fair and competitive pay decisions.
 Due to government regulation only US persons (U.S. citizen, U.S. naturalized citizen, U.S. permanent resident, holder of U.S. approved political asylee or refugee status) may be considered for this role.
 Chromalloy participates in E-Verify and will provide the federal government with your Form I-9 information to confirm that you are authorized to work in the U.S.
 Any offer of employment will also be conditioned upon the successful completion of a background investigation and drug screen in accordance with company policy and applicable federal and state regulations.
 Chromalloy is an equal opportunity employer - vets/disabled.
 In the United States, if you need a reasonable accommodation for the online application process due to a disability, please contact: https://www.chromalloy.com/contact-us/

IT Cybersecurity - IT Security Analyst

Al Adyat consultancy

Role OverviewOwns end-to-end delivery of threat intelligence onboarding and integration using Anomali, including architecture, data ingestion, enrichment, correlation, and integration with Splunk SIEM and Splunk SOAR to enhance detection, investigation, and automated response capabilities.Key Responsibilities&middot; Lead solution architecture and detailed design (HLD / LLD) for threat intelligence integration&middot; Deploy, configure, and optimize Anomali Threat Intelligence Platform&middot; Onboard threat intelligence feeds and manage lifecycle, scoring, and confidence tuning&middot; Integrate Anomali with Splunk SIEM for enrichment, correlation, and detection enhancement&middot; Integrate threat intelligence into Splunk SOAR playbooks for automated response&middot; Implement use cases aligned to SOC investigation and threat hunting workflows&middot; Validate data quality, mappings, and enrichment effectiveness&middot; Troubleshoot integration, data, and performance issues&middot; Produce operational documentation and conduct knowledge transfer to run teams&middot; Support stabilization and transition into BAU operationsSkills and Experience&middot; Strong hands-on experience with Anomali Threat Intelligence Platform&middot; Experience integrating threat intelligence with Splunk SIEM and Splunk SOAR&middot; Strong understanding of threat intelligence lifecycle, IOC management, and enrichment&middot; Knowledge of SOC operations, threat detection, and incident response&middot; Experience producing technical design and operational handover documentationKey Deliverables&middot; Threat intelligence architecture and integration design documentation&middot; Configured Anomali TIP integrated with Splunk SIEM and SOAR&middot; Enrichment and correlation use cases implemented&middot; Runbooks, SOPs, and formal handover to operationsPay: QAR12,000.00 - QAR14,000.00 per monthEducation:<ul><li>Bachelor's (Required)</li></ul>Experience:<ul><li>Anomali Threat Intelligence Platform: 3 years (Required)</li><li>Splunk SIEM and Splunk SOAR: 3 years (Required)</li></ul>Language:<ul><li>Arabic (Required)</li><li>English (Required)</li></ul>License/Certification:<ul><li>degree in computer science (Required)</li></ul>Location:<ul><li>Doha (Required)</li></ul>Work Location: In person

Threat Intelligence Specialist (Anomali / Splunk)

NMC Health plc

<div>Actively monitor the networks, systems, applications, IT assets and bio-medical equipment&rsquo;s for suspicious activity and threats. Using offensive and defensive measures and information collected from a variety of sources to identify, analyze, and report events that occur or may occur within the network and make the initial decision on the event/ threat severity.</div>
 <div><ul><li>Manage network, intrusion detection and prevention systems.
</li><li>Conduct periodic compromise assessments across selected networks and propose recommendations based on assessment results.
</li><li>Conduct physical security assessment of the organization&rsquo;s systems, including servers and networks, ensuring that any unauthorized external physical interference is not actually possible.
</li><li>Conduct ongoing network hunt activities.
</li><li>Conduct proactive vulnerability assessment across the network, subnetworks and service traffic to identify potential points of intrusion.
</li><li>Research and develop methods of tracking and detecting malicious activity within a network.
</li><li>Develop tools, signatures, and methods of detection for use in incident response activities.
</li><li>Develop SIEM integrations, dashboards, and analytics to illuminate and visualize threat activity.
</li><li>Analyze network traffic to provide timely detection, identification, and alerting of possible attacks/intrusions, anomalous activities, and misuse activities and distinguish these incidents and events from benign activities.
</li><li>Uses data collected from a variety of cyber defense tools (e.g., anti-virus, IDS alerts, firewalls, network traffic logs) to analyze events that occur within their environments, perform cyber defense trend analysis and reporting, and perform event correlation to mitigate threats and gain situational awareness and determine the effectiveness of an observed attack.
</li><li>Carries out triage to ensure that a genuine security incident is occurring.
</li><li>Coordinate with entity-wide cyber defense staff to validate network alerts.
</li><li>Notify designated managers, cyber incident responders, and cybersecurity service provider team members of suspected cyber incidents and articulate the event&rsquo;s history, status, and potential impact for further action in accordance with the organization&rsquo;s cyber incident response plan.
</li><li>Document and escalate incidents (including event&rsquo;s history, status, and potential impact for further action) that may cause ongoing and immediate impact to the environment.
</li><li>Provide daily summary reports of network events and activity relevant to cyber defense practices.
</li><li>Analyze identified malicious activity to determine weaknesses exploited, exploitation methods, effects on system and information.
</li><li>Validate intrusion detection system (IDS) alerts against network traffic using packet analysis tools.
</li><li>Isolate and remove malware.
</li><li>Develop content for cyber defense tools use them for continual monitoring and analysis of network activity to identify malicious activity.
</li><li>Assist in the construction of signatures which can be implemented on cyber defense tools in response to new or observed threats within the network environment.
</li><li>Analyze and report organizational security posture trends.
</li><li>Monitor external data sources (e.g., cyber defense vendor sites, Computer Emergency Response Teams, Security Focus, Threat Intelligence Providers) to maintain updated of cyber defense threat condition and determine which security issues may have an impact on the enterprise.
</li><li>Provides cybersecurity recommendations based on significant threats and vulnerabilities.
</li><li>Provide advice and input for Disaster Recovery, Contingency, and Continuity of Operational Plans.
</li><li>Collect and analyze intrusion artifacts (e.g., source code, malware, and system configuration) and use discovered data to enable mitigation of potential cyber incidents within the enterprise.
</li><li>Use specialized equipment and techniques to catalog, document, extract, collect, package, and preserve digital evidence.
</li></ul>Utilize deployable forensics toolkit to support operations as necessary</div>
 <div>Knowledge
<ul><li>Security concepts such as cyber-attacks and techniques, threat vectors, risk and threat management, incident management etc.
</li><li>Networking concepts and protocols, and network security attacks, vulnerabilities, processes, methodologies, access control mechanisms, traffic analysis methods.
</li><li>Cyber threats and vulnerabilities and information dissemination sources (e.g., alerts and advisories).
</li><li>Cyber defense and vulnerability assessment tools and their capabilities.
</li><li>System and application security threats and vulnerabilities (e.g., buffer overflow, mobile code, cross-site scripting, Procedural Language/Structured Query Language [PL/SQL] and injections, race conditions, covert channel, replay, return-oriented attacks, malicious code).
</li><li>Scripting languages (e.g., Python, Perl, Bash) used in an incident response environment
</li><li>Incident response and handling methodologies.
</li><li>Intrusion Detection System (IDS)/Intrusion Prevention System (IPS) tools, applications, methodologies and techniques for detecting host and network-based intrusions.
</li><li>Threat investigations, reporting and investigative tools.
</li><li>Cyber defense and information security policies, procedures, and regulations.
</li><li>Common attack vectors, the different classes of attacks (e.g., passive, active, insider, close-in, distribution attacks) and attack stages (e.g., reconnaissance, scanning, enumeration, gaining access, escalation of privileges, maintaining access, network exploitation, covering tracks).
</li><li>Cyber attackers (e.g., script kiddies, insider threat, non-nation state sponsored, and nation sponsored), and attackers&rsquo; methodologies.
</li><li>Signature implementation impact for viruses, malware, and attacks.
</li><li>Windows/Unix ports and services.
</li><li>Relevant laws, legal authorities, restrictions, and regulations pertaining to cyber defense activities.
</li><li>Packet-level analysis using appropriate tools (e.g., Wireshark, tcpdump).
</li><li>Use of sub-netting tools.
</li><li>Penetration testing principles, tools, and techniques.
</li><li>Investigation, auditing and forensics methods, processes, procedures and standards.
</li><li>Different types of hardware, storage, imaging and file system analysis.
</li><li>Data backup and recovery.
</li></ul>Skills
<ul><li>Using SIEM/SOAR and Vulnerability Management tools and services.
</li><li>Sysadmin skills (Linux/Mac/Windows).
</li><li>Programming skills (Python, Ruby, PHP, C, C#, Java, Perl, and more).
</li><li>Identifying, analyzing and interpreting trends or patterns in complex data sets.
</li><li>Developing and deploying signatures.
</li><li>Detecting host and network-based intrusions via intrusion detection technologies (e.g., Snort).
</li><li>Using incident handling methodologies.
</li><li>Collecting data from a variety of cyber defense resources.
</li><li>Recognizing and categorizing types of vulnerabilities and associated attacks.
</li><li>Performing packet-level analysis.
</li><li>Conducting trend analysis.
</li><li>Using cyber defense reporting structure and processes.
</li><li>Utilizing a combination of automated and manual testing methods.
</li><li>Developing automated vulnerability testing scripts and using off the shelf vulnerability testing tools.
</li><li>Conducting vulnerability scans and recognizing vulnerabilities in networks, systems and applications.
</li><li>Using of penetration testing tools and techniques.
</li><li>Applying analytical and problem-solving skills.
</li></ul>Ability
<ul><li>Collaborate with other sections across the department to enhance detection capabilities.
</li><li>Perform Malware analysis.
</li><li>Work closely with management to respond appropriately to the results of assessments and mitigation oversight of found vulnerabilities.
</li><li>Perform data analysis, correlation, and analytics leveraging Security Information and Event Management (SIEM) tools.
</li><li>Conduct vulnerability scans and recognize vulnerabilities in security systems &amp; devices.
</li><li>Accurately and completely source all data used in intelligence, assessment and/or planning products.
</li><li>Apply techniques for detecting host and network-based intrusions using intrusion detection technologies.
</li><li>Interpret the information collected by network tools (e.g. Nslookup, Ping, and Traceroute).
</li><li>Prepare and create regular reports to document any security breaches/ incidents.
</li><li>Provide forensic support to Cyber Security Operations during the investigation of any detected threat or contained incident / event to determine root cause and propose response recommendations as required.
</li></ul>Education and Certification
<ul><li>Bachelor&rsquo;s degree in an information technology, computer science, cyber security or equivalent work experience.
</li><li>CompTIA Security+
</li><li>CISSP: Certified Information Systems Security Professional
</li><li>GCFA: GIAC Certified Forensic Analyst
</li><li>GCIH: GIAC Certified Incident Handler
</li><li>GCIA: GIAC Certified Intrusion Analyst
</li><li>OSCP: Offensive Security Certified Professional
</li><li>CEH: Certified Ethical Hacker
</li><li>CPT: Certified Penetration Tester
</li></ul>Experience
<ul><li>3 years of experience in cyber security operations with expertise in managing the Security Operations Center
</li><li>UAE experience preferred.</li></ul></div>

Information Security Specialist

Search 10000+ Security operations center (soc) analyst jobs near you this May. New roles added regularly across leading industries. Apply today.