Senior Cloud Security Operations Analyst

Role & responsibilities:

• Perform security monitoring of Pega Cloud commercial environments using multiple security tools/dashboards
• Perform security investigations to identify indicators of compromise (IOCs) and better protect Pega Cloud and our clients from unauthorized or malicious activity
• Actively contribute to incident response activities as we identify, contain, eradicate, and recover
• Contribute to standard operating procedure (SOP) and policy development for CSOC detection and analysis tools and methodologies
• Assist in enhancing security incident response plans, conducting thorough investigations, and recommending remediation measures to prevent future incidents.
• Perform threat hunts for adversarial activities within Pega Cloud to identify evidence of attacker presence that may have not been identified by existing detection mechanisms
• Assist the threat detection team in developing high confidence Splunk notables focused on use cases for known and emerging threats, based on hypotheses derived from the Pega threat landscape
• Assist in the development of dashboards, reports, and other non-alert based content to maintain and improve situational awareness of Pega Cloud's security posture
• Assist in the development of playbooks for use by analysts to investigate both high confidence and anomalous activity

Preferred candidate profile:

• SANS, Offensive Security, or other top-tier industry recognized technical security certifications focused on analysis, detection, and/or incident response
• Industry recognition for identifying security gaps to secure applications or products What You've Accomplished:
• Minimum of 6+ years of industry-relevant experience, with a demonstrated working knowledge of cloud architecture, infrastructure, and resources, along with the associated services, threats, and mitigations.
• Minimum of 4+ years in operational SIEM (Security Information and Event Management) roles, focusing on analysis, investigations, and incident response, with experience in Google Chronicle SIEM being an added advantage.
• 3+ years of operational cloud security experience preferably AWS and/or GCP including knowledge and analysis of various cloud logs such as CloudTrail, Cloud Audit, GuardDuty, Security Command Center, CloudWatch, Cloud Ops, Trusted Advisor, Recommender, VPCFIow, and WAF logs.
• 4+ years of operational experience with EDR/XDR platforms and related analysis and response techniques
• Operational experience performing investigations and incident response within Linux and Windows hosts as well as AWS, GCP, and related Kubernetes environments (EKS/GKE)
• Solid working knowledge of MITRE ATT&CK framework and the associated TTP's and how to map detections against it, particularly the cloud matrix portion
• Familiarity with the OWASP Top 10 vulnerabilities and best practices for mitigating these security risks.
• A solid foundational understanding of computer, OS (Linux/Windows), and network architecture concepts, and various related exploits/attacks
• Experience developing standard operating procedures (SOPs), incident response plans, runbooks/playbooks for repeated actions, and security operations policies
• Experience with Python, Linux shell/bash, and PowerShell scripting is a plus
• Excellent verbal and written communication skills, including poise in high pressure situations
• A demonstrated ability to work in a team environment and foster a healthy, productive team culture
• A Bachelor's degree in Cybersecurity, Computer Science, Data Science, or related field