SOC Analyst

Location: Remote work is possible. Experience: 3 - 6 years. Salary: ₽. Discussed during the interview. Company: Xello.

Responsibilities: • Development and refinement of security event normalization, enrichment, and correlation rules for various sources; • Implementation of detection mechanisms/rules; • Validation of created detections through simulation of real attacks; • Development, updating, and implementation of incident response (IR playbooks) scenarios; • Development of automation scenarios; • Investigation and timely escalation of security incidents; • Documentation of configuration, integrations, and system setup instructions.

Requirements: • Experience in developing correlation and detection rules "from scratch" for specific threats and TTPs, experience in testing their effectiveness (analysis of false positive/negative); • Experience in investigating security incidents and developing recommendations for their prevention; • Experience in automating internal SIEM, SOAR processes; • Experience with Windows/Linux systems and understanding of their main attack vectors; • Knowledge of main attack vectors at the network level and web application/API level; • Basic scripting skills (bash, PowerShell, Python); • Skills in writing SQL queries, Yara rules, Sigma rules; • Understanding of methods for detecting main attack vectors and types, attacker tactics and techniques (Cyber Kill Chain, MITRE ATT&CK, TTP, etc.); • Understanding of the OSI network model, TCP/IP stack, network protocols HTTP/HTTPS, DNS, DHCP, ARP, etc.; • Ability to analyze security tool logs, OS logs, network equipment logs, database logs; • In-depth knowledge: SIEM systems (Wazuh, ELK, etc.), OWASP.

Apply.