Position: SOC Expert
Company: GeeksForLess Inc.
Category: Security
Experience required: 5y
English level: upper

Program and showcase which connects the Top Scaleups in the digital and software space is looking for SOC Security Expert to join an ongoing project. Usual CET working hours. Long-term cooperation.

**Duties:**
Monitoring of the defined input channels for IT security events and processing.
Further development of the tools and methodologies relevant to the CDC.
• Monitoring of input channels for IT security events
• Investigation of IT security events
• Initiation of activities to prevent cyber attacks and limit damage
• Execution of security incident handling
• Collection of relevant logs and data on IT security events
- Creation of Playbooks and Standard Operating Procedure
• Analysis of logs and data for IT security events
• Tool-based communication and escalation of security incidents
• Carrying out customer communication and internal communication in the event of security incidents (unless communication is assigned to other roles depending on the assessment of the security incident)
• Improvement of the monitoring and analysis methods used
• Development and updating of use cases to identify IT security incidents based on profiles (except for authorisation monitoring)
• Comprehensive evaluation/correlation of different information sources/logs to detect security events
• Cause analyses/in-depth analyses & detailed classification in the context of security events
• Control of the weak point scans and the TARGET/ACTUAL comparisons (e.g. commissioning the elimination of weak points or of TARGET/ACTUAL deviations) in the specialist departments
• Independent verification of the correct functioning of the tools • Independent reporting of deviations from specifications as part of the vulnerability scans and TARGET/ACTUAL comparisons
• Escalation in the event of major risks, serious security incidents or untreated compliance violations (e.g. non-performance of TARGET/ACTUAL comparisons)
• Independent observation of relevant sources in the security environment to identify threats and dangers
• Independent reporting of threats and dangers to the head of department via a bridgehead function in the team
• Initiation of eliminating vulnerabilities (vulnerability scans) and compliance violations (target/actual comparisons)
• Monitoring of input channels for IT security events
• Receipt of reports on (potential) IT security incidents
• Reaction to (potential) IT security incidents to limit damage and restore according to the specifications and processes (incl. playbooks, standard operating procedures)
• Monitoring of the functionality of the vulnerability scans
• Transmission of the results of the vulnerability scans to the departments
• Allocation of the results of the TARGET/ACTUAL comparisons to the departments
-Creation of FRI policies in cooperation with the FI-TS departments
-Rollout and troubleshooting of Qualys agents on end devices via a proxy chain
-Build an exception workflow in ServiceNow for single device exceptions
All tasks are provided using various tools and processed independently.