We are looking to hire Cyber Security Operations Analyst for our HK listed client.
Key Responsibilities:
- SOC Detection and Response, Assist in the security monitoring, detecting and analysis of events related to security, ensuring proactive and appropriate defense.
- Support the investigation and remediation of the existing threat arising from central event monitoring tools.
- Participate in the Use Case Development supported by the SIEM and security tools.
- Act as a point of escalation from SOC L1 for detecting security events within and outside the team.
- Provide quality assurance (review the work of SOC L1, events suppression, improvement of
- templates, etc.) and create various SIEM dashboards and reporting.
- Participate on the creation of technical procedures, handling guidelines and playbooks.
- Work with the global SOC and Operations Team (Asia and EU Business Unit and Group Level) on responding and resolving events generated by the SIEM.
Security Projects & Deployments
- Drives the implementation of the central event monitoring tools.
- Coordinates the implementation of the other projects when necessary. Lead the integration, deployment, and various testing.
Daily Operations
- Ensure various tickets and escalated security issues are being handled in a timely manner
- When needed, conduct forensic investigations, malware analysis, reverse engineering, advanced investigation utilizing various in-house and open-source security tools.
- Prepares various reports and metrics as defined by the management.
- Attends meeting and participate to various cyber exercises.
Person Specification
- Degree holder in Computer Science or related disciplines. GIAC Cyber Security Cert or CISSP qualification is a big plus.
- At least 5 to 10 years experiences in IT; 5+ years of experience in information security incident handling and SOC operations.
- Experience supervising a medium-sized Security Team
- Hands on Cyber security solution implementation and operation, especially in SIEM and various security tools.
- Certified Splunk Core Certified Power User, Enterprise Security Administrator or Splunk Enterprise Admin is highly preferred.
- Strong problem-solving skills and fast learner.
- Liaison skill & teamwork, passion & commitment mentality
- Good interpersonal and communication skills.
- Good command of written and spoken English and Chinese (Mandarin and Cantonese)
Technical Requirements
- Solid support experiences on Splunk operations and project implementations including the integration of other enterprise security tools such as SOAR, EDR, Enterprise Anti-virus, Vulnerability Management, and other supporting tools.
- Basic experience on Splunk systems maintenance and troubleshooting (Splunk components like Heavy Forwarders and Deployment Servers)
- Basic events handling experience in EDR (MS MDE), NDR (Vetra AI), MS Sentinel interface.
- Well experienced in security incident handling.
- Broad knowledge of cyber security concepts including vulnerabilities, web and application security, access controls and secure architectures.
- Experience in ITSM tools.
