Security Operation Center (SOC) Level 2 Technician

This is a remote position.

SUMMARY

The Security Operation Center (SOC) Level 2 Technician is responsible for monitoring and detecting security events within a client environment. This includes reviewing complex security incidents that require deeper investigation into possible security incidents. 

JOB RESPONSIBILITIES

• Monitor security alerts that are reported by the various security tools and Endpoint Detection and Response (EDR) platforms
• Determine the severity and urgency of the alerts and perform initial triage
• Run various scans on workstations and remediate any issue with infections
• Escalate threats to the SOC Manager when necessary
• Review client’s emails to determine their legitimacy to prevent phishing or malicious from being released to the end user
• Determine if changes to email and web filter settings are required in end user profiles to reduce false positives
• Document incidents and remediation steps taken during the triage process
• Isolate endpoints and block IPs that are potential risks
• Control conditional access policies to block security risks such as impossible travel
• Manage country blocking rules to allow users access when traveling
• Configure and monitor SIEM tools
• Conducting comprehensive log analysis and forensic examinations

Requirements

QUALIFICATIONS

• Firm understanding of networking and cybersecurity principles
• Advanced knowledge of the capabilities of the email filtering platforms that are utilized in client environments
• Strong understanding of TCP/IP, firewalls and VPNs
• Strong attention to detail and analytical thinking
• Excellent communication skills for incident reporting
• Ability to explain the necessary steps taken to the end users when taking measures to protect their environment
• Expertise in utilizing SIEM tools to determine the severity of security incidents, fine tuning the tools to prevent false positives

Certifications

• CompTIA A+ (required)
• CompTIA Network + (required)
• CompTIA Security + (required)
• CompTIA Security Analyst (required)
• Certified SOC Analyst (required)
• Microsoft SC-200 Security Operations Analyst Associate