Job Description

• Must have experience supporting 24x7x365 SOC or Cyber Watch operations.
• Must be a self-starter and display the ability to research and find the answer “On your own”.
• Must be able to work with minimal to no supervision.
• Must be able to learn new technologies and techniques provided by the SOC Chief as well as “On your own”.
• Must be able to read, write, and comprehend at the intermediate level.
• Must be able to read, comprehend, and apply standard operating procedures, playbooks, and directives provided by the SOC Chief.
• Must have and understand and applied knowledge of the full Triage process to determine if an event is a true positive or false positive. 
• Must be able to hypothesize during an event to determine an outcome.
• Must have basic - intermediate understanding of various cyber-attacks (new and old) across various platforms and environments including Active Directory, Windows, Linux. Cloud is a plus.
• Must know how to perform basic-intermediate Splunk searches in Splunk Enterprise Security to obtain various information as needed and/or requested by senior leadership
• Must know how to perform basic-intermediate threat hunting in Splunk for various cyber-attacks including, but not limited to: User Behavior Analysis, Privileged User activity, Advanced Persistent Threat (APT) activity, and other ad hoc searches as needed and/or requested
• Must be able to identify root-cause using various native and security tools (Splunk Enterprise Security, Trellix, ACAS, SolarWinds)
• Must be able to read and comprehend various log types.
• Must be able to correlate logs to investigate various cyber events and incidents using native and security tools (Splunk Enterprise Security, Trellix, ACAS, SolarWinds)
• Must have basic - intermediate understanding and applied knowledge of networking fundamentals to include, but not limited to most common ports and protocols, what they are, and how they work)
• Must have a basic - intermediate understanding and applied knowledge of command line tools to obtain information needed for triage analysis including, but not limited to windows command line, Linux command line, PowerShell, etc.
• Prior Help desk and system administrators with ticket handling, Active Directory, and command line scripting experience preferred and are encouraged to apply.