- Monitor and respond to security alerts from a variety of security and IT tools (e.g. Microsoft Sentinel).
- Proactively analyse security alerts to detect anomalous behaviour and identify potential threats
- Prioritising alerts according to their criticality, tackling threats in the first instance and escalating when required.
- Limit business disruption from malicious activity, contain and eradicate malicious activity from information systems.
- Operate SIEM tools to high efficiency, provide suggestion for continuous improvement through creation and tuning of SIEM rules.
- Documentation of incidents and investigations.
- Research the latest on security/cyber threats, which can drive improvements with existing tools and processes.
- 12-months experience working within a Security Operations Centre (SOC).
- Hands-on experience with Security Incident and Event Management (SIEM) tools (e.g. Azure Sentinel, MS Defender, Splunk, SentinelOne, CrowdStrike)
- Familiarity with Endpoint Detection and Response (EDR) tools.
- Relevant SOC/Cyber Security certifications (e.g. Blue Team Level 1, SC-900, CompTIA Security+, CompTIA Network+)
- Proactive attitude towards developing in Cyber Security.