Security Analyst-GSOC

Overview

Security Analyst within Arete's GSOC, responsible for monitoring, investigating and mitigating threats across client environments using SentinelOne, QRadar SIEM and related tools.

What you'll do

• Review alerts generated by SentinelOne and implement appropriate containment and mitigation measures.
• Perform threat monitoring and hunting within SIEM environments, with a focus on QRadar SIEM.
• Analyze payloads using JoeSandbox and escalate to the appropriate team as necessary.
• Collaborate with the Forensics team to conduct threat hunting using identified Indicators of Compromise (IoCs) and Tactics, Techniques, and Procedures (TTPs).
• Assist the Tiger Team in targeted collections of systems based on identified malicious activities in the client's environment.
• Conduct historical log reviews to support threat hunting efforts and ensure all malicious artifacts are mitigated in the SentinelOne console.
• Examine client-provided documents and files to supplement the SOC investigation and mitigation strategy.
• Conduct perimeter scans of client infrastructure and report identified vulnerabilities to the Tiger Team for escalation.
• Manage client-related tasks within the ConnectWise Manage ticketing system as part of the Client Handling Lifecycle.
• Create user accounts in the SentinelOne console for clients.
• Generate Threat Reports showcasing activity observed within the SentinelOne product.
• Execute passphrase exports as needed for client offboarding.
• Submit legacy installer requests to ensure the team is properly equipped for deployment.
• Provide timely alert notifications to the IR team of any malicious activity impacting clients.
• Assist with uninstalling and migrating SentinelOne.
• Generate Ranger reports to provide visibility into client environments.
• Manage and organize client assets (multi-site and multi-group accounts).
• Apply appropriate interoperability exclusions relating to SentinelOne and client applications.
• Perform SentinelOne installation and interoperability troubleshooting as needed.
• Contribute to the overall documentation of SOC processes and procedures.
• Participate in Handler on Duty (HOD) shifts as assigned to support TT client matters.
• Internally escalate support tickets and alerts to Tier II-IV Analysts as needed.
• Perform other duties as assigned by management.

What you'll need

• Associate's degree and 6+ years of IT related experience, or Bachelor's Degree and 2-5 years related experience.
• Current or previous knowledge of, or previous experience with, Endpoint Detection and Response (EDR) toolsets.
• General knowledge of the Incident Handling Lifecycle.
• Ability to communicate in both technical and non-technical terms, orally and in writing.
• Demonstrated knowledge of Windows and Unix operating systems.
• Thorough understanding of Digital Forensics and Incident Response practices.
• Proficiency in advanced analysis techniques for processing and reviewing large datasets in various formats.
• Familiarity with TCP/IP and OSI Model concepts at a basic level.
• Expertise in the Incident Response Life Cycle stages (Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learned).
• Working knowledge of the MITRE ATT&CK framework at an intermediate level.
• Proven ability to work independently and solve complex problems with little direction from management.
• Highly detail-oriented and committed to producing quality work.

Details

• Location: Hyderabad, India.
• Usual office working conditions.
• Travel within or outside of the state.
• Job is exempt from the overtime provisions of the Fair Labor Standards Act.