Head of Information Security Monitoring Architecture and Services (SOC)

What you will do:

• create and develop SOC services;
• form IR teams;
• organize the writing of new scenarios and response rules for SOAR Security Vision;
• implement SOC automation processes;
• coordinate the work of team members during incident response;
• implement new response methodologies and tools;
• analyze incident trends;
• monitor response time compliance;
• develop response scenarios for complex incidents;
• participate in the investigation of complex incidents;
• develop Threat Intelligence and Forensics areas.

What we expect from you:

• knowledge of network protocols, OS (Windows/Linux), command line;
• knowledge of security tools (SIEM, IDS/IPS, FW, EDR);
• analysis of logs and traffic;
• Incident Response, Threat Hunting;
• knowledge of cyber threat types (Malware, Ransomware, Phishing, DDoS, APT);
• attack vectors and penetration methods;
• cyber attack stages (Cyber Kill Chain, MITRE ATT&CK);
• malware classification (viruses, Trojans, worms, rootkits);
• methods of bypassing security tools (Evasion Techniques);
• vulnerabilities of operating systems and network equipment (CVE);
• principles of operation of main protocols (TCP/IP, HTTP, DNS, SMTP, SMB);
• network security principles (Firewall, IDS/IPS, VPN);
• social engineering techniques;
• working with SIEM (ELK, PT SIEM, KUMA, Splunk, QRadar, etc.);
• traffic analysis (Wireshark, PT NAD, Suricata);
• malware analysis;
• Endpoint forensics;
• development of content for SIEM;
• working with version control (GitLab).