Envestnet/Yodlee - Lead - Security Operations Centre

Its a Scheduled Drive on the SSE role.

Lead SOC :

- Lead 6 to 8 years experienced professional having working experience in managing security devices like IDS,Firewalls, vulnerability scanners, SIEM, etc. Working experience of Linux, VMware, AWS, Openstack, etc.

- Should have script writing skills and should be adept at using them to automate complex tasks. Should have at least 2 to 3 years experience working in cloud technologies - AWS & Openstack. Should have good communication skills and should be open and keen to learn new technologies

- Conduct initial triage, declare events/incidents, create incident cases, gather evidence, track and update incident status

- Analyze various open source and paid threat intelligence and use them for threat hunting activities

- Identify and develop areas for automation.

Description :

Job Title : Lead - SOC

Exempt or Non-Exempt- : Department- : Yodlee Security Office

Reporting Structure :

Reports to Sr. Manager, Security Operations Centre

Summary of Position:

To work as Lead -SOC

Primary Responsibilities- :

Key responsibilities of the job :

1. Conduct initial triage, declare events/incidents, create incident cases, gather evidence, track and update incident status

2. Analyze various open source and paid threat intelligence and use them for threat hunting activities

3. Develop and track key performance indicators (KPIs) and metrics for operational success.

4. Identify and develop areas for automation.

Work Experience :

6 to 8 years experienced professional having working experience in managing security devices like IDS,Firewalls, vulnerability scanners, SIEM, etc. Working experience of Linux, VMware, AWS, Openstack, etc.

- Should have script writing skills and should be adept at using them to automate complex tasks. Should have at least 2 to 3 years- experience working in cloud technologies: AWS & Openstack. Should have good communication skills andshould be open and keen to learn new technologies.

Skills :

1. Excellent communication skills both verbal and written

2. Experience in Event Correlation and Analysis

3. Experience in vulnerability assessments, Penetration testing

4. Experience in handling events thrown by DAM tool.

5. Experience in patch management, configuration management

6. Should have sound knowledge of Splunk/QRadar/any SIEM solution, IOC discovery tools, intrusion detection systems etc.

7. Should have strong knowledge in few of the Virtualization (Microsoft Hyper V/Citrix Xendesktop/VM VDI) and Cloud Technologies like AWS, VMWare, OpenStack, Microsoft Azure etc.

8. Must have a strong knowledge of the Operating System (Windows andLinux), Domain, Active Directory and its concepts, interaction between Hardware, OS, Network, Storage and Application Software.

9. Should have deep understanding of open source technologies such as cloud open and open stack

10. Ability to analyze network traffic, large sets of log data, and other relevant security data to hunt for potential adversary activity

11. Establishing traffic and data flow baselines to identify anomalies; as well as developing hypotheses based on real-world cyber threat intelligence, defining data models to prove out hypotheses and conducting analysis on the associated data sets

12. Need to have experience in programming python to solve cyber security challenges.

13. Experience doing dynamic malware analysis

14. Perform deep packet analysis to identify attacks, vectors and security threats.

15. Good knowledge of OWASP Top 10.

16. Ability to create, modify, and implement both Snort and YARA signatures.

17. Prior experience in network forensics with an emphasis on detecting malicious activity using network traffic

18. Strong scripting and task automation skills

19. Provide knowledge to improve and mature the services and capabilities of the SOC.

20. Responsible for SOC communication and metrics report delivery to senior management

21. Identify unknown threats for our global clients through advanced threat hunting services to complement standard Security Operations Center services.

22. Experience in a security role with strong working knowledge and understanding of information security frameworks

Certifications :

SIEM Certified/Trained or, CCNA/CEH Certified, VM Tool certified/Trained, RHCE, Cloud technology certifications desirable