Position: SOC Expert
Company: GeeksForLess Inc.
Category: Security
Experience required: 5y
English level: upper
Published: 2023-03-01T00:00:00+02:00

Program and showcase which connects the Top Scaleups in the digital and software space is looking for SOC Security Expert to join an ongoing project. Usual CET working hours. Long-term cooperation.

**Duties:**
Monitoring of the defined input channels for IT security events and processing.
Further development of the tools and methodologies relevant to the CDC.
• Monitoring of input channels for IT security events
• Investigation of IT security events
• Initiation of activities to prevent cyber attacks and limit damage
• Execution of security incident handling
• Collection of relevant logs and data on IT security events
- Creation of Playbooks and Standard Operating Procedure
• Analysis of logs and data for IT security events
• Tool-based communication and escalation of security incidents
• Carrying out customer communication and internal communication in the event of security incidents (unless communication is assigned to other roles depending on the assessment of the security incident)
• Improvement of the monitoring and analysis methods used
• Development and updating of use cases to identify IT security incidents based on profiles (except for authorisation monitoring)
• Comprehensive evaluation/correlation of different information sources/logs to detect security events
• Cause analyses/in-depth analyses & detailed classification in the context of security events
• Control of the weak point scans and the TARGET/ACTUAL comparisons (e.g. commissioning the elimination of weak points or of TARGET/ACTUAL deviations) in the specialist departments
• Independent verification of the correct functioning of the tools • Independent reporting of deviations from specifications as part of the vulnerability scans and TARGET/ACTUAL comparisons
• Escalation in the event of major risks, serious security incidents or untreated compliance violations (e.g. non-performance of TARGET/ACTUAL comparisons)
• Independent observation of relevant sources in the security environment to identify threats and dangers
• Independent reporting of threats and dangers to the head of department via a bridgehead function in the team
• Initiation of eliminating vulnerabilities (vulnerability scans) and compliance violations (target/actual comparisons)
• Monitoring of input channels for IT security events
• Receipt of reports on (potential) IT security incidents
• Reaction to (potential) IT security incidents to limit damage and restore according to the specifications and processes (incl. playbooks, standard operating procedures)
• Monitoring of the functionality of the vulnerability scans
• Transmission of the results of the vulnerability scans to the departments
• Allocation of the results of the TARGET/ACTUAL comparisons to the departments
-Creation of FRI policies in cooperation with the FI-TS departments
-Rollout and troubleshooting of Qualys agents on end devices via a proxy chain
-Build an exception workflow in ServiceNow for single device exceptions
All tasks are provided using various tools and processed independently.