Position: SOC Manager
Category: Security
English level: upper
Years of experience: 5


My journey started in a newly established SOC as an L1 in a large company. From the beginning, my responsibilities were only to monitor and improve my skills. After a year I was responsible for SIEM administration (creating/tuning rules, add log sources, eventcollection optimization), Vulnerability Assesment, Risk managment. I also participated in the implementation of EDR systems and was responsible for the integration of SOAR system to optimize SOC processes.  I have deep practical knowledge in forensic tools like Autopsy, ProcDump, disk2vhd and ect. as a member of the CSIRT. Assist Team Leads with reporting, projects, administrative work as needed.
   The next step on my way was French SOC as a service. The main task was to optimize SOC processes, at that time the team was overloaded with the number of customers and alerts that were generated. I also managed the implementation process and implemented EDR in clients.
   One of my projects was the creation of SOC, i.e. integration of SIEM system, implementation of monitoring and incident response processes, improvement of company processes to improve security in general, creation of periodic Vulnerability Assessment processes.
   Now I work in MSSP team as Incident Response Manager and Senior Threat Inlegence. Being an Incident Response Manager coordinates all efforts to contain and resolve the incident. Leads communications and conference calls with the team, stakeholders, customers, and others to provide updates. Additionally, Incident Response Manager documents all activities occurring during the incident following policy and using established methodologies. 
-Research new cyber threats, actors, and technologies that impact the organization and industry.
-Maintain awareness within the threat intelligence community of vulnerabilities being exploited and provide comprehensive assessments on the impact to our environment.
-Translate threat intelligence into detection and hunting strategies, hypotheses, and queries.
-Identify anomalous behavior on the network or endpoint devices and be able to provide an assessment of malware behavior.
-Provide guidance on building and/or improving information security processes and implementation of tools and technologies used for enterprise security. Use existing tools to provide metrics to support recommendations.
-Provide support (including off-hours) to analyze and triage potential incidents.