Security Detection and Response Analyst
Core
Detect, investigate, and respond to targeted attacks against critical customer-facing assets by analyzing logs and events.
Role type
Security Detection and Response Analyst (SOC L2/L3)
Builds
Macros, alerts, and dashboards in Splunk to surface targeted attacks
Domain
Financial services, cybersecurity, web application security
Required skills
Intrusion analysis, Splunk, SIEM tools, HTTP/HTTPS, DNS, TLS, SQL injection, cross-site scripting, remote file inclusion, incident response, scripting languages, regular expressions, enterprise client/server architecture, Web Application Firewalls (WAF), CDN security controls
Preferred skills
Akamai or other CDN security controls experience
Responsibilities
Analyse web, application, authentication, endpoint and security appliance logs to identify malicious activity; Use Splunk to investigate security events and build macros, alerts and dashboards; Identify common exploits and attack patterns from web and event logs; Interpret Apache, IIS and Active Directory logs; Detect anomalous or malicious network activity using advanced analytics; Support incident response and implement mitigations including WAF and CDN security controls; Interpret stateful firewall rules and contribute to security operations procedures.
Seniority
Intermediate to expert capability, equivalent to L2/L3 in a tiered SOC model
