Perform regular fine-tuning and optimization of detection rules, correlation logic, and alert thresholds across SIEM, EDR, and other security platforms to enhance detection accuracy and reduce false positives.
Act as the designated point-of-contact and primary responder to receive alerts from the Security Operations Centre (SOC) team upon detection of potential incidents, ensuring effective coordination and execution of necessary response actions.
- Act as the organisation's early warning system by continuously observing network traffic, analysing system logs, and managing Security Information and Event Management (SIEM) tools to spot suspicious activities and filter out false alarms before a potential threat escalates.
The ideal candidate is analytical, detail-oriented, and calm under pressure, and works effectively with infrastructure and application teams to drive remediation.
Assess exploitability and potential business impact of excessive privileges, insecure configurations, weak controls, technology vulnerabilities, and exposed services.
Perform basic configuration changes, troubleshooting, and initial incidence assessments before escalating to a backend support team according to pre-established procedures and runbook
Drive agency onboarding, integration and migration engagements from requirements gathering through UAT sign off to production cutover, including Government Commercial Cloud (GCC/GCC+) landing zone migrations, firewall and service account service requests, and re architecting legacy agent based integrations to direct connectivity models.
Conduct and support forensic investigations across systems, networks, memory, and disk, while analyzing attacker techniques, persistence mechanisms, and data exfiltration paths to uncover the full scope of incidents
Support security reviews throughout the software development lifecycle, including the review of technology designs, security requirements and application security assessments.
Perform basic configuration changes, troubleshooting, and initial incidence assessments before escalating to a backend support team according to pre-established procedures and runbook