Position: SOC Analyst / Engineer
Category: Security
English level: upper
Years of experience: 2.5

Bachelor's degree in Cybersecurity
Master's degree in Cybersecurity
Certified Splunk Power User
Have developed:
- custom integration to collect audit logs from Confluence Cloud to Splunk
- custom integration to collect threats from SentinelOne, map to CIM and send them to TheHive as alerts
Important note: will be able to start working on a new project not earlier than the 1st of July.

Main responsibilities on the current position:
- deployment and configuration of SIEMs (mainly Splunk and Elastic Cloud) for a clients, including but not limited to deployment set-up and configuration of logs ingestion using various methods (including custom ones)
- content development for various SIEM platforms (visualizations, reports, etc.)
- development of correlation rules for SIEM platforms for various data sources based on MITRE ATT&CK framework an emerging threats
- support and continuous improvement of clients' SIEM platforms (i.e. leading False Positive remediation process, additional content development, etc.)
- automation of routine SOC tasks using Python/Bash scripts
- preparation and presentation of monthly reports on security posture of customers' environment (in English)

Previous experience:
- monitoring of clients' security posture, triage of security alerts in various SIEMs and EDRs as L1 and L2 analyst in 24/7 mode

Additional experience:
- development of custom API integrations between various security tools (i.e. EDR + TheHive) on Python
- performing researches of security tools and presenting result of a research to a team
- vulnerability management
- was employed after internship
Interested to have a lot of administrative/engineering/content development tasks related to security tools (SIEMs, EDRs, etc.), to work as part of security or SOC team.