L3 Principal SOC Analyst

About Us

Integrity360 is one of Europe’s leading cyber security specialists operating from office locations spread out across Europe, providing a comprehensive range of professional, support and managed cyber security services for our 300+ clients. With four top-class Security Operation Centers, we offer a complete end-to-end security services covering our clients’ security from every angle. Our services include Managed Security, Cyber Security Testing, Incident Response, Security Integration, PCI Compliance and Cyber Risk & Assurance services.

What sets Integrity360 apart is our excellent team of people that drive the business forward. The company was founded with a focus on technical expertise and that philosophy remains today. The skills and experience in our company are some of the greatest in the industry and clients remain with Integrity360 because they can rely on and trust us to go above and beyond to ensure their needs are met. Listed multiple times on Gartner Market Guides for Managed Security Services.

Job Role / Responsibilities

In this role you will be expected to perform traffic analysis, intrusion analysis and detection of threats based on system alerts and logs. Additional duties would include the authoring of security procedures. You will be required to monitor third party security related websites, forums, and mailing lists for information regarding new threats and vulnerabilities. The security analyst will verify security events as security incidents; correlate and collate the information; and develop, edit, and deliver security reports to enterprise-level customers. The role requires flexibility and the ability to work extra hours when the business calls for it. A good knowledge of Information Security is required for this role.Proactive client services, such as compromise assessments and evaluating and recommending tools and technology for incident response are also in scope. Demonstration of a strong comprehension of malware, emerging threats and adversary TTPs will be critical to success.

Primary Duties/Responsibilities include:

• Review security events to evaluate the risk they present in the context of the environment they are in.
• Analyse logs for anomalies in the environment.
• Perform in-depth investigation on confirmed security incidents.
• Identify, contain and eradicate threats in the environment.
• Perform analysis of malicious code and activity.
• Tuning security toolsets.
• Document complete details and evidence of investigation and providing reports to incident stakeholders.
• Responsible for generating reports to the partners and stakeholders showing internal threat landscape.
• Document work efforts and update the tool documents that are already in place.
• 24 x 7 on-call support on a rota basis may form part of the role.

Desired Skills

• Experience working with security event detection tools like IPS, SIEM, DLP, Anti-virus, etc.
• Ability to perform event correlation, host/ network threat analysis.
• Ability to manage multiple incidents and make effective decisions under high pressure environment.  
• Experience in performing analysis on network pcaps and documents for malicious activity or codes.  
• Conceptual knowledge in Networks and Network Security.
• Understanding of Network infrastructure hardware and protocols (TCP/IP, switches, bridges, routers, proxy servers, VPN concentrators).
• Understanding of Security protocols (IPSec), and encryption technologies (3DES, AES, SHA2, TLS).
• Understanding of basic security principles such as Confidentiality, Availability, Integrity.
• Familiar with security best practices.
• A process of on-going certification for the benefit of the business and for self-development is encouraged .
• Review the adequacy of the security controls and their ability to protect the information system and its information.
• Experience with Splunk is a plus.
• Experience using SIEM & IPS solutions is a plus.
• Strong Microsoft Word & Microsoft Excel skills required.

Certifications/Qualifications

• Any of the following accreditations/certification will be highly beneficial: 
• Security industry certifications: GSEC, GCIH, GCFA or similar security certifications.
• 2+ years in an Incident Handling role or a CSIRT role.
• Ideal candidates will possess a working knowledge of Intrusion Prevention System (IPS), SIEM, SOAR & DLP.
• Experience working with threat hunting tools.