Security Operations Specialist

Incident Analysis & Response

• Perform L3 validation of alerts escalated by RQ GreyMatter AI.
• Conduct deep-dive investigations on true positives, anomalous safe events, and "no response" alerts.
• Correlate data across CrowdStrike, Google SecOps, IAM logs, network telemetry, and cloud environments.
• Recommend tactical and strategic response actions.

Automation & Tuning:

• Identify false positives and propose detection logic improvements.
• Enhance automated playbooks based on observed patterns.
• Contribute to adversary simulations and attack path mapping.

Threat Intelligence & Hunting

• Perform proactive hunting using CrowdStrike/Google SecOps datasets.
• Identify emerging threats relevant to oil & gas / energy sector.
• Conduct behavior-based analysis beyond signature indicators.

Governance, Reporting & Stakeholder Engagement

• Prepare daily/weekly operational summaries.
• Provide recommendations for reducing risk exposure.
• Maintain documentation of incidents, playbooks, and detection updates.

Required Skills:

• 4+ years SOC experience (L2/L3 level)
• Strong hands-on experience in:
• CrowdStrike Falcon (Detection, Response, RTR, Threat Hunting),
• Google SecOps / Chronicle / Google SIEM
• Security automation frameworks
• MITRE ATT&CK mapping
• Cloud platforms (AWS/Azure/GCP)
• Experience with threat detection, malware behavior, and IR methodology

Analytical Skills:

• Strong critical thinking
• Ability to validate AI-driven decisions
• Ability to identify tuning opportunities
• Strong pattern-recognition skills in threat behaviours
• Soft Skills
• Excellent communication skills
• Ability to work independently during shifts
• Cross-functional collaboration with customer & RQ teams
• Ownership mentality and continuous improvement mindset

Preferred Certifications:

• CrowdStrike CCFR / CCSA / CCP
• Google Cybersecurity Professional / SecOps Certifications
• GCIA, GCED, GCIH, or equivalent
• Azure/AWS/GCP security certifications