SOC Security Engineer

Location: This is a remote position and we are considering candidates from Toronto, CA.

The SOC Security Engineer  is an integral part of our services organization providing expert knowledge in security best practices, security controls and advanced analysis to our customers. Knowledge in creation of detections, security engineering and DevSecOps into production.This team member will be critical for protecting clients from emerging threats.

Responsibilities:

• Configure tools and detect patterns/outliers within client environments matching tactics, techniques or procedures (TTPs) of known threat actors, malware or other unusual or suspicious behaviors.
• Monitor  security tools in multiple client environments and ensure out detection / prevention are working operationally.
• Contribute to executive summary reports and on the delivery of detection / preventions for customers. 
• Design, develop and manage the DevSecOps process for the emerging threats.
• Provide cross-functional support of this DevSecOps process,
• Work with the greater threat team to ensure delivery of a quality service. 
• Operate as subject matter expert (SME) point of contact for clients during business hours.
• Ownership of the DevSecOps Documentation and Training.

Qualifications:

• Bachelor’s Degree in Cybersecurity related field preferred
• 2+ years of Cybersecurity experience
• Significant experience using  one SIEM platform i.e. Splunk / Elastic Search
• Must have experience with IDS/ IPS one or more of:  i.e. Snort, Suricata, Zeek
• 1+ years experience with Python with Git 
• Advanced knowledge of log analysis, PCAP analysis, traffic flow analysis and experience with associated infrastructure and systems to aid in the identification of malware or other malicious behavior.
• Demonstrated or advanced experience with computer networking systems.
• Experience with operational security, including security operations center (SOC), incident response, evidence assessments, malware analysis, or IDS and IPS analysis.
• Knowledge of networking protocols and infrastructure designs; including routing, firewall functionality, host and network intrusion detection systems, encryption, load balancing, and other network protocols.
• Knowledge of TTPs involved in current APT threats and exploits involving various operating systems, applications and protocols, including working knowledge of the Cyber Kill Chain and MITRE ATT&CK Matrix.
• Excellent written and verbal communication skills, analytical ability, and the ability to work effectively with peers. 
• Ability to both support partner meetings and projects.
• Desire to learn how to apply machine learning to cybersecurity problems is a plus.
• Experience with DevSecOps