Security Operations Center Analyst- Technical Support Specialist

Location: Augusta,Maine,United States

OFFICE OF INFORMATION TECHNOLOGY - MAINEIT

SECURITY OPERATIONS CENTER ANALYST II

THIS POSITION IS AN ON-SITE POSITION IN AUGUSTA, ME

Opening Date:  June 3, 2024

Closing Date:  June 17, 2024

Job Class Code: 0870
Grade: 27
Salary: $64,990.64 - $87,834.24 (includes 15% stipend and eligible for an additional 5% training bonus) 
Position Number: 004250761

The Office of Information Technology, Information Security Office is seeing a Security Operations Center Analyst II (Technical Support Specialist) to serve as vital member of the Security Operations Center within the MaineIT Information Security Office, performing continuous monitoring of critical systems for the State of Maine. The candidate will be a member of a team focused on endpoint detection and response, antivirus protection, endpoint investigations, and other endpoint security and incident response activities. The candidate must be knowledgeable about how the products and processes fit into the broader Security Program and generally understand information security concepts, methods to combat against emerging threats, and adversary Tactics, Techniques, and Procedures.

The candidate will be primarily responsible for Tier II level SOC Analyst duties with our Endpoint Security and Incident Response group with an opportunity for participating in our Vulnerability Management and Testing processes as needed to meet the operational requirements and goals of the SOC. The Information Security Office SOC located in Augusta, Maine, provides 24x7 security monitoring support, and requires the position to participate in an on-call rotation. Work is performed under limited supervision.

Representative Tasks: 

• Understanding of detection and response, antivirus, and other endpoint security topics based on industry best practices.
• Understanding of detection and response, antivirus, and other endpoint security product features to effectively use the tools to monitor security threats and to engage in endpoint investigations and incident response activities.
• Understanding of threat hunting methodologies and of various Tactics, Techniques, and Procedures used by threat actors.
• Ability to work independently and with a team in meeting organizational goals and objectives.
• Ability to manage detection and response, antivirus, and other endpoint security solutions to monitor and contain threats.
• Ability to effectively work with members of the SOC and other MaineIT teams to document polices and processes, and to provide analysis reports as required.
• Ability to recognize common attack vectors such as, recon scans, botnet, malware, command, and control activity (C2), worms, trojans, and viruses.
• Ability to use correlation tools such as log aggregation tools or a SIEM for analysis.
• Knowledge in designing, implementing, administering, and troubleshooting endpoint security configurations to strengthen protections, minimize gaps, and improve endpoint client performance.
• Knowledge in client device management and vulnerability management identification and remediation.

Required Skills and Experience, and Relevant Education:

• A minimum of 6 years of a combination of related post-secondary education, technical certifications, or technology related work experience. Related training, internship experience etc. may be credited as related experience on a month-per-month basis.
• The ideal candidate will have knowledge of Windows and Linux systems and their associated scripting languages, experience with AWS or Azure cloud environments, and will have worked with endpoint security platforms such as Microsoft Defender for Endpoint, FireEye, Crowdstrike, McAfee, or similar, and with vulnerability testing products such as Windows Defender TVM, Tenable Nessus, Rapid 7 InsightVM, Qualys, or similar. Experience with any of the popular SIEM platforms is also desired (Splunk, Azure Sentinel, Sumo Logic, LogRhythm, Elasticsearch, etc.)
• Preference will be given to those with at least five years of information security experience, with a focus on Endpoint Security, Incident Response, and Vulnerability Management within an enterprise environment is preferred. One or more relevant technical security certifications are a plus (GIAC, ISC2, CompTIA, EC Counsel, etc.

The selected candidate will be required to pass the required background checks(fingerprinting may be required) as a condition of employment.

Benefits of working for the State of Maine:

No matter