Job Description

Responsibilities:
• Develop and maintain detection capabilities using technologies and frameworks such as Sigma, YARA, and other detection rules.
• Perform Digital Forensics and Incident Response (DFIR) activities to support security incident investigation, containment, and root cause analysis.
• Monitor and analyze daily cybersecurity threats, vulnerabilities, security advisories, and emerging attack techniques relevant to the organization and its customers.
• Conduct periodic SOC visibility and log completeness assessments to identify gaps in security monitoring and detection coverage.
• Perform IOC analysis and enrichment based on integrated security logs, threat intelligence sources, and other relevant data.
• Develop and enhance detection use cases and correlation rules to identify potential security threats based on IOCS, TTPS, and observed attack patterns.
• Maintain comprehensive documentation for detection capabilities, including detection logic, use cases, rule development, validation, and tuning.
• Conduct Proof of Concept (POC), testing, validation, and quality assessment of new detection capabilities before production implementation.
• Perform threat hunting activities to proactively identify suspicious activities, advanced threats, and potential indicators of compromise within monitored environments.
• Provide knowledge transfer and technical guidance to SOC Analysts across L1- L3 to improve investigation, detection, and incident response capabilities.
• Collaborate with SOC, Security Engineering, and other technical teams to continuously improve detection coverage, monitoring visibility, and overall SOC capabilities.