BlueVoyant
SOC Security Analyst
BlueVoyant, San Francisco, California, United States, 94199
SOC Security Analyst
Location: Tulsa, OK preferred. Open to Remote US for Exceptional Candidate
This position requires shift work: Wednesday – Saturday, 4 X 10s with an hour lunch, 12pm – 11pm Central.
US Citizenship Required
Summary
BlueVoyant is looking for Security Operations Center (SOC) Analysts (Level 2) to help our global customers manage their IT security. You will be part of a fast-paced team that helps customers to reduce the impact of security incidents and ensures that critical business operations continue unhindered.
Key Responsibilities
Monitor and analyze security events and alerts from multiple sources, including security information and event management (SIEM) software, network and host-based intrusion detection systems, firewall logs, and system logs (Windows and Unix), and databases.
Separate true threats from false positives using network and log analysis and escalate possible intrusions and attacks.
Initiate tickets, document, and escalate to higher-level security analysts.
Perform alert triage and investigations of incoming issues (assess the priority, determine risk).
Maintain a strong awareness of the current threat landscape.
Basic Qualifications
Excellent teamwork skills.
Knowledge of and experience with intrusion detection/prevention systems and SIEM software.
Knowledge and understanding of network protocols and devices.
Experience with Mac OS, Windows, and Unix systems.
Ability to analyze event logs and recognize signs of cyber intrusions/attacks.
Ability to handle high pressure situations in a productive and professional manner.
Written and verbal communication skills and the ability to present complex technical topics in clear and easy-to-understand language.
Teamwork and interpersonal skills, including the ability to work effectively with a globally distributed team.
Able and willing to work in a 24/7/365 environment, including nights and weekends, on a shift schedule.
Ability to provide tuning recommendations for security tools to tool administrators.
Familiarity with tools such as Wireshark, TCP Dump, Security Onion, and Splunk.
Basic knowledge of the following:
SIEM.
Packet Analysis.
SSL Decryption.
Malware Detection.
HIDS/NIDS.
Network Monitoring Tools.
Case Management System.
Web Security Gateway.
Email Security.
Data Loss Prevention.
Anti-Virus.
Preferred Qualifications
Experience and/or understanding of network/host vulnerability analysis, intrusion analysis, or related areas.
Familiarity of the MITRE Framework.
Experience with security tools such as Microsoft Azure, Microsoft Defender, Carbon Black, Splunk, and CrowdStrike.
KQL, regex, or other query language experience.
Hands-on SOC or Incident Response experience.
Security +, Network +, GCIA, CCNA, CEH, RHCA, RHCE, MCSA, MCP, MCSE or related certification(s).
Familiarity with GPO, Landesk, or other IT Infrastructure tools.
Education
Minimum bachelor’s degree in Information Security, Computer Science, or other IT-related field or equivalent professional experience. Exceptional candidates with proven experience in security/network operations will also be considered.
#J-18808-Ljbffr
Location: Tulsa, OK preferred. Open to Remote US for Exceptional Candidate
This position requires shift work: Wednesday – Saturday, 4 X 10s with an hour lunch, 12pm – 11pm Central.
US Citizenship Required
Summary
BlueVoyant is looking for Security Operations Center (SOC) Analysts (Level 2) to help our global customers manage their IT security. You will be part of a fast-paced team that helps customers to reduce the impact of security incidents and ensures that critical business operations continue unhindered.
Key Responsibilities
Monitor and analyze security events and alerts from multiple sources, including security information and event management (SIEM) software, network and host-based intrusion detection systems, firewall logs, and system logs (Windows and Unix), and databases.
Separate true threats from false positives using network and log analysis and escalate possible intrusions and attacks.
Initiate tickets, document, and escalate to higher-level security analysts.
Perform alert triage and investigations of incoming issues (assess the priority, determine risk).
Maintain a strong awareness of the current threat landscape.
Basic Qualifications
Excellent teamwork skills.
Knowledge of and experience with intrusion detection/prevention systems and SIEM software.
Knowledge and understanding of network protocols and devices.
Experience with Mac OS, Windows, and Unix systems.
Ability to analyze event logs and recognize signs of cyber intrusions/attacks.
Ability to handle high pressure situations in a productive and professional manner.
Written and verbal communication skills and the ability to present complex technical topics in clear and easy-to-understand language.
Teamwork and interpersonal skills, including the ability to work effectively with a globally distributed team.
Able and willing to work in a 24/7/365 environment, including nights and weekends, on a shift schedule.
Ability to provide tuning recommendations for security tools to tool administrators.
Familiarity with tools such as Wireshark, TCP Dump, Security Onion, and Splunk.
Basic knowledge of the following:
SIEM.
Packet Analysis.
SSL Decryption.
Malware Detection.
HIDS/NIDS.
Network Monitoring Tools.
Case Management System.
Web Security Gateway.
Email Security.
Data Loss Prevention.
Anti-Virus.
Preferred Qualifications
Experience and/or understanding of network/host vulnerability analysis, intrusion analysis, or related areas.
Familiarity of the MITRE Framework.
Experience with security tools such as Microsoft Azure, Microsoft Defender, Carbon Black, Splunk, and CrowdStrike.
KQL, regex, or other query language experience.
Hands-on SOC or Incident Response experience.
Security +, Network +, GCIA, CCNA, CEH, RHCA, RHCE, MCSA, MCP, MCSE or related certification(s).
Familiarity with GPO, Landesk, or other IT Infrastructure tools.
Education
Minimum bachelor’s degree in Information Security, Computer Science, or other IT-related field or equivalent professional experience. Exceptional candidates with proven experience in security/network operations will also be considered.
#J-18808-Ljbffr