Security Operations Analyst – SIEM Operations, Threat Detection

🔥 il y a 22 heures

🇪🇸 Espagne – Télétravail

⏰ Temps Plein

🟡 Intermédiaire

🟠 Senior

🛡️ Opérations de sécurité

👻 Score fantôme 11%

Ce que ça veut dire : la probabilité que cette offre reste ouverte sans recrutement actif.Comment le lire : 60 % ou plus, on pense que c'est une offre fantôme. Un score plus bas est moins inquiétant.Comment on la calcule : ancienneté, republications, postes ouverts vs taille de l'équipe, rapidité de clôture, et si le salaire est indiqué.À noter : une estimation à partir de données publiques, pas un jugement sur l'entreprise. De vraies offres peuvent avoir un score élevé, alors prenez-le comme un indice, pas comme un fait.

Postuler Maintenant

Trouver des Emplois à Distance Similaires

Configurer une alerte email pour les nouveaux emplois

📊 Vérifiez votre score de CV pour ce poste

Améliorez vos chances d'obtenir un entretien en vérifiant votre score de CV avant de postuler.

Télécharger le CV

Talan

Site WebLinkedInTous les Emplois

1001 - 5000 employés

Fondée en 2003

💼 Conseil

🏢 Entreprise

☁️ SaaS

💰 Secondary Market en 2020-07

Consulting • Enterprise • SaaS

Talan est un groupe international spécialisé dans l’accompagnement des organisations par l’innovation et la transformation positives. Présent dans 18 pays sur 5 continents, Talan propose un large éventail de solutions qui améliorent la prise de décision, intègrent la technologie au cœur des stratégies métier et réinventent les modèles économiques pour renforcer la résilience et l’excellence opérationnelle. Talan excelle en gestion et gouvernance des données, en solutions propulsées par l’IA, en cybersécurité et sur les plateformes cloud. En s’alliant aux principaux éditeurs technologiques tels que Microsoft, SAP, Oracle et Salesforce, Talan ambitionne de démocratiser l’usage de la data et d’accélérer les transitions bas-carbone. L’entreprise se concentre également sur des secteurs comme l’énergie, les transports, les services financiers, entre autres, en apportant des insights et des solutions adaptés aux besoins spécifiques de chaque industrie.

Description

• Enhance threat detection and cybersecurity operations capabilities within the Cyber Security Operations Center • Develop, implement, validate, tune and maintain security monitoring, analytics and detection capabilities across SIEM, EDR, cloud and other cybersecurity platforms • Operate, maintain, optimize and continuously improve security monitoring and threat detection services • Onboard, integrate, test and validate security data sources, telemetry feeds and monitoring capabilities • Manage security content, including detection use-case lifecycles, rule reviews, testing, tuning and content quality assurance • Collaborate with cyber threat intelligence, incident response and cybersecurity operations teams to translate requirements into detection and monitoring capabilities • Participate in cybersecurity architecture reviews and provide recommendations to improve monitoring and detection effectiveness • Prepare and maintain cybersecurity operations metrics, dashboards, KPIs and service performance reports • Review and assess detections, monitoring configurations, operational processes and service deliverables, identifying improvement opportunities • Analyze operational feedback to optimize tuning, reduce false positives and improve detection quality • Contribute to quality assurance, process reviews, control validation, service quality assessments and corrective actions • Maintain CSOC procedures, standards, documentation, knowledge-base articles and operational guidance • Prepare and present technical reports, summaries, findings and recommendations to internal and external stakeholders • Participate in the mandatory rotating on-call schedule to resolve critical incidents when required

🎯 Exigences

• Mandatory participation in a rotating 24/7 on-call shift schedule from Monday to Sunday; approximately one full week every X months depending on team size • 5+ years of relevant experience in information technology, including alert triage and security incident support • Proven experience administering a SIEM platform, preferably Splunk or Microsoft Sentinel SIEM • Proven experience with SOC tools such as SIEMs and EDRs; ability to independently perform technical analysis of security threats and collaborate with the Incident Response team • Deep knowledge of Microsoft Security Tools, including M365, Cloud App Security, Azure, Defender for Endpoint, Azure Security, Azure Sentinel and XDR • Deep knowledge of cloud technologies such as Azure, AWS and GCP • Deep knowledge of SIEM tools such as Splunk, QRadar, ArcSight, MS Sentinel and ELK Stack • Knowledge of at least one EDR solution, such as MS Defender for Endpoint or CrowdStrike • Knowledge of email security, network monitoring and incident response • Knowledge of Linux, Mac and Windows • C1 English proficiency • Experience building SIEM architectures from initial design to implementation, including data ingestion pipelines for diverse cloud and on-premises log sources • Proven knowledge monitoring AWS environments (IaaS, SaaS, PaaS) • Knowledge of at least one general-purpose or shell scripting language, such as Ruby, Bash, PowerShell or Python • Desirable certifications include MCSE, CCNA, Microsoft Azure SC-200, GCIH, CEH, GCFA or any GIAC/similar certification • Excellent communication skills • Customer-facing and oral communication experience • Ability to write documentation and reports • Creativity and ability to find innovative solutions • Willingness to learn on the job • Conflict management and cooperation

🏖️ Avantages

• Remote position • Freelance, full-time contract • Training and career development • Possibility to be part of a multicultural team and work on international projects