Specialist II, Security Incident Response Team (TCF)

SOC Operations & Security Monitoring

• Lead and manage the 24/7 Security Operations Center (SOC), ensuring continuous threat detection and response.
• Working extensively on SIEM (XSIAM. Arcsight, Splunk, QRadar, ELK, Sentinel, etc.) and other security monitoring tools.
• Oversee 24/7 monitoring of security events and alerts.
• Ensure effective use of SIEM (Security Information and Event Management) tools.
• Prioritize, analyze, and manage security incidents.
• Improve threat intelligence capabilities and integrate with threat intelligence feeds.Continuously optimize detection rules, correlation logic, and security alerts to minimize false positives and improve response times.
  

Incident Response & Management

• Develop and enforce incident response plans (IRPs).
• Ensure timely response to cyber threats, minimizing impact.
• Coordinate with stakeholders during major incidents.
• Conduct post-incident analysis and lessons learned exercises.
  

EDR/XDR (Endpoint Detection & Response / Extended Detection & Response)

• CrowdStrike Falcon – AI-powered threat detection with real-time response.
• Palo Alto XDR – Extended Detection and Response.
• Microsoft Defender for Endpoint – Integrated with Azure security solutions.
• – Behavioral AI-driven endpoint protection.
• Carbon Black (VMware) – Next-gen EDR with cloud analytics.
• Sophos Intercept X – Machine-learning-based ransomware prevention.
  

Threat Intelligence Platforms (TIP)

• Recorded Future – AI-driven threat intelligence analysis.
• MISP (Malware Information Sharing Platform) – Open-source threat sharing platform.
• Flashpoint Threat Intel
• Outseer AFCC ( Previously RSA)
• IBM X-Force Exchange – Intelligence-sharing with global threat data.
• Anomali ThreatStream – Automated threat intelligence processing.
• VirusTotal Enterprise – File and URL malware scanning with shared intelligence.
  

Required Technical Skills & Experience:

• Experience: 3+ years in cybersecurity
• SIEM & Log Analytics: XSIAM, ArcSight, Splunk, Elastic Stack (ELK), QRadar, Microsoft Sentinel
• Threat Intelligence: MITRE ATT&CK, Cyber Kill Chain, MISP, STIX/TAXII.
• Incident Response & Forensics: Volatility, Wireshark, FTK, EnCase, Sleuth Kit, YARA.
• Endpoint Security & EDR/XDR: CrowdStrike Falcon, Microsoft Defender, Palo Alto XDR, SentinelOne, Carbon Black.
• Cloud Security: AWS GuardDuty, Azure Security Center, Google Chronicle, CSPM, CNAPP.
• Compliance & Risk: NIST 800-53, ISO 27001, PCI-DSS, SOC2, GDPR, CIS Benchmarks.
  

If you are a California resident, by submitting your information, you acknowledge that you have read and have access to the Job Applicant Privacy Notice for California Residents

R1649222