Incident Response, SOC Level 3, Security Operations, 3rd Line SOC, Sentinel One, Splunk

Nexere Consulting Limited

Incident Response Manager, Level 3 is required to work for a global manufacturing company on a fully remote basis. The Incident manager will have 7+ years of working within an international, multicultural SOC and dealing with other SOC teams members across the globe.

The Incident Response Manager will be managing level 1, level 2 SOC Analysts across the EMEA, APAC region and the escalations as and when they arise.

THIS IS AN INSIDE IR35 CONTRACT POSITION

What will you be doing?

• The role will encompass being a Security Subject Matter Expert (SME), and will lead, guide, and inspire the team of security analysts with a view to develop these skills amongst the team whilst also acting as a technical escalation point. As such, the role requires a deep technical understanding of intrusion detection and analysis, incident response, vulnerability management, and infrastructure.
• Driving forward the technical skill set of the team by developing threat hunting, adversary emulation, leading edge threat mitigation methodologies and security use cases.
• Understand complex IT environments with broad range of knowledge around networking, system administration, database platforms and develop defensive methodologies around likely methods of attack.
• Experience in analysing a wide range of log sources, data normalization and querying of data using analytical platforms (eg Splunk, Hadoop, Elastic, Kibana, MDE and MCAS) Sentinel One.
• Identification of malware types, infection methods, providence, and objective of the malware. This will also require extraction of IoC’s and TTP’s
• To assist and develop investigations and respond to security incidents.
• A self-starter is required for this role and the successful applicant will be able to demonstrate taking ownership of and responsibility for resolving issues.

Experience Required:

• Demonstrated experience of managing, investigating and responding to cyber incidents.
• Deep knowledge and understanding of co-ordinating cross-organisational responses to security incidents.
• In depth knowledge of technical security systems, security architecture, security technology, and associated penetration testing and Security Event Management methodologies.
• In-depth knowledge of Splunk queries, dash boarding, Use case creation and Enterprise Security.
• In depth knowledge of Cyber Security Methodologies including the Cyber Kill Chain, Mitre ATT&CK Framework, NIST, MITRE Def3nd.
• Ability to identify developing patterns and trends in data and be able to provide incident root cause analysis, with a view to identifying and influencing future prevention by maintaining the Incident knowledge base.
• Experience of other security technologies & defences such as Firewalls, Snort, Bro, Intrusion Detection System (IDS) monitoring and custom rule creation (YARA), TCP/IP Networking, WireShark, TCPDump, Netflow analysis.
• In depth understanding of IT systems and technologies (eg Linux and Windows operating systems, E-Mail, Proxies, Endpoint Protection).
• Working knowledge of SIEM architecture, XDR and Vulnerability Management, Incident Response tooling such as Hive.
• Sandboxing technologies such as Cuckoo and Malware reverse engineering IE IDA Pro, OLE debugger (both static and dynamic analysis required), and a good understanding of REMnux.
• Knowledge of Data Protection (GDPR) and its role within a business. Technical & Management reporting to demonstrate effectiveness and value of the teams work.

Other Skills Required.

Incident Management

3rd line responsibilities

Confluence, Jira, Tableau

Google Chronicle

Splunk

Sentinel One

Poppulo