soc manager

Accenture Middle East

<div> <div> <div> <p><br></p></div><div> </div> <p> </p> <p> <b>Job Summary:</b> </p> <p> </p> </div> <div> <p> <span>The IT/OT SOC Delivery Lead is responsible for managing and delivering security operations across both IT (Information Technology) and OT (Operational Technology) environments. This role ensures comprehensive threat detection, response, and monitoring capabilities for corporate systems and industrial control systems (ICS/SCADA). The ideal candidate has deep knowledge of cybersecurity frameworks, IT/OT convergence challenges, and a proven track record in leading SOC operations in critical infrastructure sectors.</span> </p> </div> <div> <p> </p> </div> <div> <p> <b>Key Responsibilities:</b> </p> </div> <div> <p> </p> <p> <b>SOC Management &amp; Delivery:</b> </p> </div> <div> <ul> <li> <p> <span>Lead end-to-end delivery of SOC services for both IT and OT environments, including 24/7 monitoring, detection, and incident response.</span> </p> </li> <li> <p> <span>Manage a team of SOC analysts, threat hunters, and incident responders aligned with both IT and OT domains.</span> </p> </li> <li> <p> <span>Oversee SOC operational processes, including alert triage, escalation, incident handling, and post-incident reviews.</span> </p> </li> <li> <p> <span>Ensure efficient service delivery by managing SLAs, KPIs, and continuous improvement metrics.</span> </p> </li> </ul> </div> <div> <p> </p> <p> <b>IT/OT Cybersecurity Integration:</b> </p> </div> <div> <ul> <li> <p> <span>Drive alignment between IT and OT security operations to support a converged cyber defense strategy.</span> </p> </li> <li> <p> <span>Collaborate with IT, OT, engineering, and plant operations teams to ensure risk-based visibility and protection.</span> </p> </li> <li> <p> <span>Lead integration of data sources from ICS, SCADA, DCS, PLCs, HMIs, and enterprise IT infrastructure into SIEM/SOAR platforms.</span> </p> </li> <li> <p> <span>Develop and refine OT-specific detection use cases and playbooks tailored to industrial threats.</span> </p> </li> </ul> <p> </p> </div> <div> <p> <b>Threat Intelligence &amp; Response:</b> </p> </div> <div> <ul> <li> <p> <span>Monitor evolving threats, vulnerabilities, and attack vectors targeting both IT and OT systems.</span> </p> </li> <li> <p> <span>Lead proactive threat hunting and analysis activities across IT/OT landscapes.</span> </p> </li> <li> <p> <span>Coordinate incident response activities including containment, investigation, recovery, and root cause analysis.</span> </p> </li> </ul> </div> <div> <p> </p> <p> <b>Governance &amp; Compliance:</b> </p> </div> <div> <ul> <li> <p> <span>Ensure adherence to industry standards and regulatory frameworks such as NIST CSF, IEC 62443, ISO 27001, and NERC CIP.</span> </p> </li> <li> <p> <span>Support audits, risk assessments, and cyber resilience exercises involving IT/OT infrastructure.</span> </p> </li> </ul> </div> </div> <p> </p> <p> </p> <p> </p> <p> </p> <div> <p> <b>Required Qualifications:</b> </p> </div> <div> <ul> <li> <p> <span>Bachelor s degree in Cybersecurity, Engineering, Computer Science, or a related field.</span> </p> </li> <li> <p> <span>14+ years of experience in cybersecurity operations, with at least 10 years in a leadership role covering both IT and OT domains.</span> </p> </li> <li> <p> <span>Strong knowledge of IT security practices, SOC operations, and ICS/SCADA/OT systems.</span> </p> </li> <li> <p> <span>Experience with SIEM, SOAR, EDR, IDS/IPS, and network security tools (e.g., Splunk, QRadar, Sentinel, Nozomi, Dragos).</span> </p> </li> <li> <p> <span>Familiarity with protocols and systems common in OT (e.g., Modbus, DNP3, OPC, Siemens, Rockwell).</span> </p> </li> </ul> </div> <div> <p> </p> </div> <div> <p> <b>Preferred Qualifications:</b> </p> </div> <div> <ul> <li> <p> <span>Relevant certifications: CISSP, GICSP, GCIA, SANS ICS410/515, CISM, or equivalent.</span> </p> </li> <li> <p> <span>Experience in oil &amp; gas, utilities, energy, or other critical infrastructure sectors.</span> </p> </li> <li> <p> <span>Strong leadership, communication, and stakeholder management skills.</span> </p> </li> </ul> </div> <div> <p> </p> </div> <div> <p> <b>Key Competencies:</b> </p> </div> <div> <ul> <li> <p> <span>Incident response &amp; threat detection</span> </p> </li> <li> <p> <span>OT risk awareness &amp; industrial safety culture</span> </p> </li> <li> <p> <span>Cross-functional leadership</span> </p> </li> <li> <p> <span>Cybersecurity governance</span> </p> </li> <li> <p> <span>Continuous improvement &amp; automation</span> </p> </li> </ul> </div> <div> <div> <p><br></p></div></div>

IT/OT SOC Manager

Accenture

<div><span style="font-size: 11px;"><b>Job Summary:</b></span></div><div><span style="font-size: 11px;"><br></span></div><div><span style="font-size: 11px;">The IT/OT SOC Delivery Lead is responsible for managing and delivering security operations across both IT (Information Technology) and OT (Operational Technology) environments. This role ensures comprehensive threat detection, response, and monitoring capabilities for corporate systems and industrial control systems (ICS/SCADA). The ideal candidate has deep knowledge of cybersecurity frameworks, IT/OT convergence challenges, and a proven track record in leading SOC operations in critical infrastructure sectors.</span></div><div><span style="font-size: 11px;"><br></span></div><div><span style="font-size: 11px;"><b>Key Responsibilities:</b></span></div><div><span style="font-size: 11px;"><br></span></div><div><span style="font-size: 11px;">SOC Management &amp; Delivery:</span></div><div><span style="font-size: 11px;"><br></span></div><div><span style="font-size: 11px;">Lead end-to-end delivery of SOC services for both IT and OT environments, including 24/7 monitoring, detection, and incident response.</span></div><div><span style="font-size: 11px;">Manage a team of SOC analysts, threat hunters, and incident responders aligned with both IT and OT domains.</span></div><div><span style="font-size: 11px;">Oversee SOC operational processes, including alert triage, escalation, incident handling, and post-incident reviews.</span></div><div><span style="font-size: 11px;">Ensure efficient service delivery by managing SLAs, KPIs, and continuous improvement metrics.</span></div><div><span style="font-size: 11px;"><br></span></div><div><span style="font-size: 11px;">IT/OT Cybersecurity Integration:</span></div><div><span style="font-size: 11px;"><br></span></div><div><span style="font-size: 11px;">Drive alignment between IT and OT security operations to support a converged cyber defense strategy.</span></div><div><span style="font-size: 11px;">Collaborate with IT, OT, engineering, and plant operations teams to ensure risk-based visibility and protection.</span></div><div><span style="font-size: 11px;">Lead integration of data sources from ICS, SCADA, DCS, PLCs, HMIs, and enterprise IT infrastructure into SIEM/SOAR platforms.</span></div><div><span style="font-size: 11px;">Develop and refine OT-specific detection use cases and playbooks tailored to industrial threats.</span></div><div><span style="font-size: 11px;"><br></span></div><div><span style="font-size: 11px;">Threat Intelligence &amp; Response:</span></div><div><span style="font-size: 11px;"><br></span></div><div><span style="font-size: 11px;">Monitor evolving threats, vulnerabilities, and attack vectors targeting both IT and OT systems.</span></div><div><span style="font-size: 11px;">Lead proactive threat hunting and analysis activities across IT/OT landscapes.</span></div><div><span style="font-size: 11px;">Coordinate incident response activities including containment, investigation, recovery, and root cause analysis.</span></div><div><span style="font-size: 11px;"><br></span></div><div><span style="font-size: 11px;">Governance &amp; Compliance:</span></div><div><span style="font-size: 11px;"><br></span></div><div><span style="font-size: 11px;">Ensure adherence to industry standards and regulatory frameworks such as NIST CSF, IEC 62443, ISO 27001, and NERC CIP.</span></div><div><span style="font-size: 11px;">Support audits, risk assessments, and cyber resilience exercises involving IT/OT infrastructure.</span></div><div><span style="font-size: 11px;"><b><br></b></span></div><div><span style="font-size: 11px;"><b>Required Qualifications:</b></span></div><div><span style="font-size: 11px;"><br></span></div><div><span style="font-size: 11px;">Bachelor's degree in Cybersecurity, Engineering, Computer Science, or a related field.</span></div><div><span style="font-size: 11px;">14+ years of experience in cybersecurity operations, with at least 10 years in a leadership role covering both IT and OT domains.</span></div><div><span style="font-size: 11px;">Strong knowledge of IT security practices, SOC operations, and ICS/SCADA/OT systems.</span></div><div><span style="font-size: 11px;">Experience with SIEM, SOAR, EDR, IDS/IPS, and network security tools (e.g., Splunk, QRadar, Sentinel, Nozomi, Dragos).</span></div><div><span style="font-size: 11px;">Familiarity with protocols and systems common in OT (e.g., Modbus, DNP3, OPC, Siemens, Rockwell).</span></div><div><span style="font-size: 11px;"><br></span></div><div><span style="font-size: 11px;">Preferred Qualifications:</span></div><div><span style="font-size: 11px;"><br></span></div><div><span style="font-size: 11px;">Relevant certifications: CISSP, GICSP, GCIA, SANS ICS410/515, CISM, or equivalent.</span></div><div><span style="font-size: 11px;">Experience in oil &amp; gas, utilities, energy, or other critical infrastructure sectors.</span></div><div><span style="font-size: 11px;">Strong leadership, communication, and stakeholder management skills.</span></div><div><span style="font-size: 11px;"><br></span></div><div><span style="font-size: 11px;">Key Competencies:</span></div><div><span style="font-size: 11px;"><br></span></div><div><span style="font-size: 11px;">Incident response &amp; threat detection</span></div><div><span style="font-size: 11px;">OT risk awareness &amp; industrial safety culture</span></div><div><span style="font-size: 11px;">Cross-functional leadership</span></div><div><span style="font-size: 11px;">Cybersecurity governance</span></div><div><span style="font-size: 11px;">Continuous improvement &amp; automation</span></div>

Flex Employee Services

<p><b>Customer-specific requirements:</b></p><ul><li>The resource must have strong prioritization, organizational, and interpersonal skills.</li><li>They must be able to work decisively and efficiently under pressure.</li><li>The resource must communicate technical concepts and risks to stakeholders with little to no cybersecurity understanding.</li><li>Ability to work as a liaison/intermediary with multiple stakeholders.</li><li>Ability to report on platform adoption, Ability to communicate project status to stakeholders on a weekly or monthly basis</li></ul><p><b>XPANSE qualifications:</b></p><ul><li>Familiarity with the Attack Surface Management or a related field in cybersecurity (eg, discovery methods, port scanning, vulnerability management, etc)</li><li>Professional experience in technical client delivery &amp; engagement and/or technical intelligence analysis</li><li>Knowledge of Advanced Persistent Threat (APT) actors and their Tactics, Techniques, and Procedures (TTPs)</li><li>Experience applying threat hunting techniques to track attack patterns to malware variants to uncover previously undetected adversary behavior</li></ul><p><b>Additional Requirements:</b></p><ul><li>Endpoint protection deployment, operationalization, troubleshooting, training experience</li><li>Experience as a Security Incident Responder or SOC analyst/manager</li><li>Experience in Python or JavaScript</li></ul><p>-------------------------------------------------------------------------</p><p><b>Job Description:</b></p><p><b>Your Career</b><br/>The Resident Engineer (newly branded Extended Expertise) is an integral part of our mission<br/>within our Professional Services team. As an Extended Expertise Engineer, you will work<br/>on-site/remote with our customer(s) supporting our mission to help them quickly and completely<br/>adopt our End Pointy Platform, leaving them more secure. This is a highly technical, hands-on<br/>role and you will develop and maintain expert-level skill sets on our products and solutions<br/>deployed within the customer's environment.<br/>Your Impact<br/>&#9679; Learn &amp; understand the customer&rsquo;s business requirements and the threat landscape that<br/>is most applicable to their industry&rsquo;s vertical sector<br/>&#9679; Endpoint protection deployment, operationalization, troubleshooting, training experience<br/>&#9679; Experience as a Security Incident Responder or SOC analyst/manager<br/>&#9679; Familiarity with cloud technologies, providers (GCP, AWS, Azure), use-cases</p><p><b>Qualifications:</b></p><p><b>Your Experience</b><br/>&#9679; Provide remote support to the customer<br/>&#9679; Familiarity with the Attack Surface Management or a related field in cybersecurity (eg.<br/>discovery methods, port scanning, vulnerability management, etc.)<br/>&#9679; Professional experience in technical client delivery &amp; engagement and/or technical<br/>intelligence analysis<br/>&#9679; Knowledge of Advanced Persistent Threat (APT) actors and their Tactics, Techniques,<br/>and Procedures (TTPs)<br/>&#9679; Experience applying threat hunting techniques to track attack patterns to malware<br/>variants to uncover previously undetected adversary behavior<br/>&#9679; Endpoint protection deployment, operationalization, troubleshooting, training experience<br/>&#9679; Experience as a Security Incident Responder or SOC analyst/manager<br/>&#9679; Familiarity with cloud technologies, providers (GCP, AWS, Azure), use-cases<br/>&#9679; Time to Value - Analyze customer requirements, provide guidance &amp; assistance<br/>throughout the customer lifecycle to ensure a quick and successful product deployment<br/>&#9679; Product Expert - Act as the product SME, working together with product and engineering<br/>teams ensuring our customers and partners get the most out of our products<br/>&#9679; Drive Product Adoption - Continuous contact with customers to expand adoption of our<br/>product by utilizing new features and developing additional innovative use cases<br/>&#9679; Networking experience in TCP/IP, OSI Model, troubleshooting, analysis<br/>&#9679; Experience in customer-facing roles<br/>&#9679; Familiarity with machine learning and its various applications within cybersecurity<br/>&#9679; Familiarity with the different enterprise security and IT products, processes, and<br/>ecosystem<br/>&#9679; Threat hunting and detection engineering experience of tuning alerts, development of<br/>custom BIOCs, and development of correlation rules for new log sources<br/>&#9679; Experience with log ingestion and parsing rules for XDR<br/>&#9679; The ability to develop and maintain scripts in Python or Powershell is a plus<br/>&#9679; Familiarity with XQL, SQL, or a query scripting language<br/>&#9679; Experience with SIEM tools, such as Splunk<br/>&#9679; Familiarity with XDR APIs<br/>&#9679; Basic Linux system administration &amp; troubleshooting experience<br/>&#9679; Ability to work under pressure and prioritize tasks accordingly</p><p>Job Type: Contract</p><p>Pay: $65.00 - $75.00 per hour</p><p>Expected hours: No less than 40 per week</p><p>Application Question(s):</p><ul><li>Are you comfortable working on W2?</li><li>Are you legally authorized to work in the United States, US Citizen?</li><li>Are you willing to work on a contract basis?</li><li>How many years of experience do you have with XDR/Xpanse?</li><li>How many years of experience do you have with Palo Alto?</li><li> How many years of experience do you have with Attack Surface Management or a related field in cybersecurity (eg, discovery methods, port scanning, vulnerability management, etc)?</li><li>How many years of experience do you have as a Security Incident Responder or SOC analyst/manager?</li><li>How many years of experience do you have with Advanced Persistent Threat (APT) actors and their Tactics, Techniques, and Procedures (TTPs)?</li><li>How many years of experience do you have with python?</li><li>How many years of experience do you have with Endpoint protection deployment, operationalization, troubleshooting, training?</li></ul><p>Work Location: Remote</p>

Extended Expertise Consultant/Network Security Consultant

Big Fish Recruitment

The Role
<br><b>Title:</b> ICT Operation Manager Reports to: Head of ICT Infrastructure & Network Department Location: Makkah, KSA Role Purpose Own day-to-day operations of the ICT infrastructure (Data Center, Core Network, ELV/Smart-City systems) to deliver high availability, security compliance (NCA), and SLA attainment. Key Responsibilities • ITIL Service Operations: Run Incident/Problem/Change/Release, Capacity & Availability, Service Continuity processes. • NOC /SOC Operations: End-to-end service monitoring & alerting (network/servers/apps/ELV), reduce MTTD/MTTR via unified monitoring, on-call playbooks, and automated remediation, Coordinate with Cybersecurity (SOC/SIEM), patch/vulnerability management, IAM/MFA, and NCA/ISO27001 compliance, • Network & Wireless: Operate core/distribution/edge (QoS, VLAN/VRF segmentation, BGP/OSPF), Wi-Fi, and maintain config/backup baselines and change windows. • Data Center Operations: Backup/restore, quarterly DR tests, virtualization & storage operations, capacity planning, and emergency procedures. • ELV systems Operations: (CCTV, Access Control, PAS, FAS, BMS, PLC, Digital Signage/VMS, etc.). • Telecom & Contractors Coordination: Work with telecom service providers (Neutral Host/DAS for GSM/4G/5G, fiber) and ICT contractors to ensure service readiness and resilience. • BCP (Business Continuity Plan)/H&S (Health & Safety): Lead technical incident response and conduct biannual tabletop drills to ensure BCP/H&S readiness. • Vendors & SLAs: Manage contract performance, spares, escalation paths, and align maintenance with approved change windows. • Reporting & CSI) Continual Service Improvement (: Produce monthly service KPIs and drive a data-led Continual Service Improvement roadmap.
<br><br>
Requirements
<br><ul>
<li>Education/Experience: BSc in Eng./CS/IT; • 8–12 years in Data Center/Network operations, • 3+ years in team leadership. • Technical Competencies: Routing/Switching (BGP/OSPF), Wi-Fi, NG firewalls, virtualization (VMware/Hyper-V), storage & backups, monitoring (SNMP/flow/logs). Hands-on exposure to cybersecurity operations, ELV systems, and telecom services (GSM/4G/5G, fiber). • Languages: Arabic and English fluency. • Preferred certs: ITIL v4, CCNP/CCIE, Fortinet/Palo Alto, VMware VCP, Microsoft/Red Hat, ISO/IEC 27001 LI/LA; familiarity with Saudi NCA cybersecurity frameworks.</li>
</ul>
About the company
<br>Service Our aim is to provide our clients and candidates with a consistent, quality service that goes beyond the norm, giving them peace of mind and complete trust in our ability to meet their needs. Knowledge Big Fish consultants specialise in their fields and have extensive experience in the region and beyond. We take pride in our knowledge and network and believe that our relationships are built on trust and integrity and are made for the long term. Care At Big Fish, as well as caring for the people we work with, we also care about the world and environment we live in, that's why Big Fish support initiatives that promote human welfare, environmental protection and sustainability.

ICT Operation Manager

Client of Tandem Search

<b>Key Results Area:</b>
<ul>
 <li><b>Strategic Oversight:</b> Provide strategic direction and oversight for the incident management process, ensuring alignment with organizational goals and objectives.</li>
 <li><b>Security Incident Management:</b> Lead the coordination of major security incidents/crisis management, ensuring that all relevant teams and stakeholders are effectively engaged and provide appropriate technical insights to the Crisis Management Team (CMT).</li>
 <li>managing incident investigation, analysis, containment, recovery, communication, and reporting</li>
 <li><b>Policy and Procedure Development:</b> Develop and refine incident management policies and procedures, ensuring they are up-to-date and effective in addressing current and emerging threats.</li>
 <li><b>Continuous Improvement:</b> Conduct thorough post-incident reviews to identify lessons learned and implement improvements to prevent future incidents.</li>
 <li><b>Training and Mentorship:</b> Provide training and mentorship to other team members, ensuring the team is well-prepared to handle incidents.</li>
 <li><b>Stakeholder Communication:</b> Maintain clear and effective communication with stakeholders, providing updates on incident status and resolution efforts.</li>
</ul>
<div> <b>Key Principles:</b>
<ul>
 <li><b>Alignment with Business Priorities:</b> Ensure alignment with organizational goals and objectives</li>
 <li><b>Ownership and Accountability:</b> Incident Manager takes full responsibility for the activities and the department s, holding themselves and the team accountable for their outcomes.</li>
 <li><b>Driving Incident Response Maturity Enhancement:</b> Proactively drives initiatives that enhance incident response and resilient cyber posture.</li>
 <li><b>Focus on Outputs and Impact:</b> Focus on delivering outputs that create meaningful impact, such as enhanced security culture and protection posture of the bank.</li>
 <li><b>Innovation and Automation:</b> Continuously seek innovative solutions and automated processes for efficiency.</li>
 <li>Continuous Learning and Improvement: Committed to learning from experiences and continuously improving relevant processes and outcomes.</li>
</ul>
<div> <b>Knowledge, Skills, and Experience:</b>
 <b>Essential knowledge</b>
<ul>
 <li>Have over 12+ years of rich experience in the information security domain and at least 6-8 years of dedicated experience in Security Incident Response.</li>
 <li>Hands-on experience in implementing and operationalizing SIEM/SOAR tools such as Sentinel, ArcSight, etc.</li>
 <li>Experience in defining and reporting KPIs for Security Incident response.</li>
 <li>Familiarity with advanced SOC monitoring technologies, risk, threat, and security measures.</li>
 <li>Knowledge across the SOC domains, including governance, control frameworks, policies, compliance management, risk management, and incident response, etc.</li>
 <li>Comprehensive knowledge of regulatory and compliance requirements and how they influence the bank's Information Security strategy.</li>
 <li>Preferably worked in the BFSI domain with proven experience in the SOC function.</li>
 <li>Strong understanding of key security standards and regulations such as NIST 800-61, CERT/CC, PCI, ISO 27035, etc.</li>
</ul>
 <b>Skills and Application</b>
<ul>
 <li>Leads the development and implementation of comprehensive Security Governance strategies that address identified risks and compliance requirements, incorporating advanced technologies and methodologies to enhance security posture.</li>
 <li>Deep understanding of Security Incident response frameworks and their application in creating robust policies.</li>
 <li>Automate potential resilient security processes to ensure continuous compliance with security best practices.</li>
 <li>Maintaining up-to-date knowledge of security trends, threats, and countermeasures.</li>
 <li>Assess and design security posture determination processes, tools, and methodologies</li>
 <li>Reviewing and approving use cases/playbooks for SIEM/SOAR tools.</li>
 <li>Continuously monitor security hygiene and performance using tools and processes</li>
 <li>Collaborate with other IS teams, Ops, and tech teams on enhancing security incident response resilience.</li>
</ul>
<div><br><ul>
</ul>
</div>
</div>
</div>

AVP Security Incident Management

Commercial Bank of Dubai

<p><br></p> <p> <strong>Job Purpose </strong> </p> <p>Lead CBD's security operations and manage incident response efforts. This role is critical in supporting the CISO office and ensuring the security and resilience of our IT infrastructure and protecting our bank's data and systems from cyber threats.</p> <p> <br> </p> <p> <strong>Principle Accountabilities </strong> </p> <p> <br> </p> <ul> <li>Oversee the daily operations of the Security Operations Center (SOC) working across 1LoD &amp; 2LoD security teams.</li> <li>Develop and implement security monitoring and incident detection strategies.</li> <li>Ensure the effective use of security tools and technologies to protect the bank's assets.</li> <li>Monitor security alerts and manage the response to potential security incidents.</li> <li>Support the CISO office Conduct regular security assessments and audits to identify vulnerabilities.</li> <li>Own the incident response plan to address security breaches and incidents.</li> <li>Lead the incident response team in investigating and resolving security incidents. (24/7 rota with leadership team)</li> <li>Coordinate with internal and external stakeholders during incident response activities.</li> <li>Conduct post-incident reviews and implement lessons learned to improve security measures.</li> <li>Ensure timely and accurate reporting of security incidents to relevant authorities and stakeholders.</li> <li>Develop and maintain a threat intelligence program to identify and analyze emerging threats.</li> <li>Collect, analyze, and disseminate threat intelligence to relevant stakeholders.</li> <li>Collaborate with external threat intelligence providers and industry peers to stay informed about the latest threats.</li> <li>Integrate threat intelligence into security operations and incident response processes.</li> <li>Provide actionable intelligence to enhance the bank's security posture and mitigate risks.</li> <li>Support risk assessments and vulnerability analysis to identify potential threats (ISMS/Projects/Change/Thematic).</li> <li>Support threat modelling as part of DevSecOps and other change activity.</li> </ul>", "order": 1}, {

Senior Manager, Security Operations & Incident Management

KiZAN Technologies

<div><div><b>SOC Analyst - Level II</b></div>
<div><b>Location: Cincinnati, OH or Remote</b></div>
<div><b>Employment Type: Full-Time</b></div><br>
<div></div>
<div><b>**KiZAN is open to remote candidates for this position. </b><b>Candidates must be US based and able to work the majority of their time in EST.</b></div><br>
<div></div>
<div><b>About KiZAN:</b></div>
<div>We make technology personal!<br>
</div><div>KiZAN is an Industry leading Microsoft Professional Services and Managed Services Provider supporting Regional, National and Global clients. We personalize technology by sparking passion, fueling purpose, and building connections.</div><br>
<div></div>
<div>Here at KiZAN, we are one team, we support each other and take the initiative to solve problems. We are fully committed to the direction chosen and always support our mission. Being a part of KiZAN means that we win together, we create an inclusive atmosphere where everyone feels accepted, a sense of purpose, and we embrace collaboration.</div><br>
<div></div>
<div><p><b>OVERVIEW</b></p>
<p>A Level 2 Analyst is a subject matter expert responsible for managing threats, disseminating information, and handling, responding to and investigating all incident escalations from the Security Operations Center. Level 2 team members are responsible for coordinating with the CSIRT process when necessary and managing incidents throughout the event life cycle. Level 2 team members will further an investigation and ensure root cause and resolution for metrics, tracking, and lessons learned are compiled, documented, and disseminated in conjunction with the CIRT process.</p>
<p>They will provide insight and expertise to examine malicious code (malware), attack vectors, network communication methods, analyze threats against target systems and networks, determine target network capabilities and vulnerabilities, support development and maintenance of new tools and techniques to exploit specific targets, and produce technical after-action reports in support of the SOC. Level 2 members will be the focal point for critical security Alert, Events, and Incidents and will serve as subject matter experts in providing recommendations to the SOC Incident Manager and other members of Information Security and IT management for escalation and remediation. Level 2 Analysts are also responsible for training and mentoring their Level 2 and Level 1 peers to improve SOC Analyst capability. Finally, Level 2 members will work with the SIEM/SOAR Engineers to develop and refine use cases within Microsoft Sentinel focusing on emerging threats.</p>
<p>The SOC Analyst reports to the SOC Manager and works in conjunction with the other team members to keep projects delivered on time and within budget.</p>
<p><b>JOB REQUIREMENTS</b></p>
<p>Knowledge and Experience</p>
<p>To be successful in this position, a candidate should have at least two years of hands-on experience as a Level 2 SOC analyst leveraging Microsoft Sentinel, M365 Defender products, and Microsoft Defender for Cloud in production environments. Teamwork and collaboration skills will be critical for this role. The ideal candidate will have knowledge of and experience with the SOC framework and be confident in their ability to make recommendations to improve upon operations.</p>
<p>Certification Path</p>
<p>At a minimum, the Microsoft Security Operations Analyst (SC-200) and Microsoft Cybersecurity Architect (SC-100) certifications or the ability to get one within 180 days of being hired. Training materials provided and the cost of the relevant tests will be covered.</p>
<p>Within year one employment, one of the following or otherwise approved additional certifications will be obtained: ITIL, CISSP, GSEC, CISA, SEC+, CEH, CySA+, AZ-500, MS-500.</p>
<p><b>AREAS OF RESPONSIBILITY</b></p>
<p>The SOC Analyst must be able to perform the following duties unassisted or with some reasonable accommodation made by the organization:</p>
<p>Cybersecurity Operations:</p>
<ul><li>Cybersecurity Analysis, Detection and Response: 40%
 <ul><li>Manage SOC event and information intake to include gathering intelligence reports, monitoring ticket queues, investigating reported incidents, and interacting with other security and network groups as necessary.</li>
<li>Continuously monitor network traffic and systems for security anomalies, intrusions, or breaches. Perform research and use systems and tools in places, such as SIEM, XDR, NAC, and other</li>
<li>Investigate Level 1 escalated Incidents.</li>
<li>Ensure SOC Triage Tagged Incidents are addressed in a timely manner using available reporting and metrics.</li>
<li>Monitor Level 1 Analyst performance investigating incoming Incidents using SOC-available tools.</li>
<li>Respond to attempted efforts to compromise security controls using documented procedures.</li>
<li>Participate in incident response exercises.</li>
<li>Coordinate with SIEM Engineers to tune Alerts and Events</li>
</ul></li><li>Cybersecurity Vulnerability and Threat Mitigation: 40%
<ul><li>Perform regular vulnerability assessments and security analyst of information technology systems.</li>
<li>Create reports showing risk and priorities and share findings with appropriate stakeholders and coordinate with them to implement security patches and other mitigation</li>
</ul></li><li>SOC process refinement and cross training: 20%
<ul><li>Improve SOC processes to elevate response efficiency.</li>
 <li>Consult the organization on security tool improvements for customers.</li>
 <li>Mentor Level 2/Level 1 Analysts to improve detection/analytical capabilities within the SOC.</li>
<li>Interview potential SOC resources and provide feedback.</li>
<li>Drive and monitor shift-related metrics processes ensuring applicable reporting is gathered and disseminated per SOC requirements.</li>
<li>Serve as shift subject matter experts on incident detection and analysis techniques providing guidance to junior analysts and making recommendations to organizational managers.</li>
<li>Track tactical issues in execution of SOC responsibilities.</li>
</ul></li></ul><p>Other</p>
<ul><li>Communicate effectively, both orally and in writing, to clearly express ideas and opinions.</li>
<li>Demonstrates teamwork, is receptive to and acts upon input from others, is willing and able to compromise as needed, displays willingness to work with all firm employees, and willingly assists others.</li>
<li>Demonstrates initiative and contributes new ideas; is self-motivated.</li>
<li>Demonstrates flexibility; willing to adjust to changes, able to work with all levels of firm employees.</li>
<li>Works with tight deadlines and under pressure.</li>
<li>Always exhibits positive leadership characteristics to the team, both in terms of improving processes and procedures and being proactive about the nature and scope of the team&rsquo;s work.</li>
<li>Generates and maintains documentation on SOC procedures performed and publishes such materials as appropriate.</li>
<li>Travels to any office location when needed, with at least a one (1) week notice.</li>
<li>Willing and able to work extended hours and rotate on-call duties to ensure customer incident response.</li>
<li>Performs other duties, responsibilities, and special projects, as requested.</li>
</ul>EEO/AA Employer</div></div>

SOC Analyst - Level II

Search 10000+ Soc manager jobs near you this October. New roles added regularly across leading industries. Apply today.

10000 soc manager jobs NEAR_ME

IT/OT SOC Manager

IT/OT SOC Manager

Extended Expertise Consultant/Network Security Consultant

ICT Operation Manager

AVP Security Incident Management

Senior Manager, Security Operations & Incident Management

SOC Analyst - Level II