Position: SOC Analyst/Engineer SIEM/SOAR Engineer
Category: Security
English level: upper
Years of experience: 4

SOAR experience:
- created 4 automated playbooks that significantly reduce alert processing time
- coded 5 integrations to collect/send information from/to SOAR
- assisted in development of 30+ playbooks for different tasks/systems/automation levels
- managed connectors and integrations, debugged errors  

SIEM experience:
- created 30+ rules of different complexity
- created automated SLA analytics reporting
- edited parsers and created parsing patterns for non-standard log sources
- assisted in creation and optimization of 40+ rules
- created custom AQL querries for reporting and fast information gathering

Incident Response experience:
- took part in more than 20+ incidents as part of incident responce team or the only incident responder
- provided instructions to mitigate malware infections, web site breach, DDoS
- took part in mitigation of unsactioned access, brute forces/password spraying, as part of the team

SOC analyst:
- took part in 100+ incidents investigations
- provided detailed reports for major incidents
- provided mitigation instructions to prevent similar incidents 

Mentoring:
- mentored 3 SOC Analysts on all SOC-related work directly
- teached 10 SOC Analysts on speceific topics with mini-lectures with practical tasks

Earned certificates:
- CompTIA Security+
- SC-900
- AZ-900
- IBM Qradar Certified Analyst
- SIEM (QRadar) content creation (correlation rules, parsing logic) and incidents investigation;
- Microsoft 365 Security incident response and investigation, custom detection rules creation(Defender for Endpoint, Defender for Identity, Defender for O365);
 - L1 Analysts mentoring;
 - Detailed incident reporting and mitigation activities development;
 - Ariel Query Language knowledge, capable of writing complex logic/rules, content for API requests or automation via SOAR;
 - Kusto Query Language knowledge for advanced investigations in MS 365 Security, Threat Hunting, API requests or SOAR automation;
 - Manual Playbooks creation for routine tasks performed by L1 Analysts;
 - Automated Playbooks creation for SOAR (SIEMplify).
What I want:
- SIEM/SOAR content creation and debugging;
 - Incidents investigation via SIEM or other systems with logging (MS 365 Security suite etc.);
 - Query writing (AQL, KQL) for complex rules/logic, API requests or SOAR automation;
 - Education (courses for used instruments and general security courses);
 - Trainees/L1 Analysts mentoring;
 - SOAR Playbooks creation and using other means for automation.
What I don't want:
- night shifts
- any work that requires speaking or writing in russian language.