Job Type :
Full-time
Essential Duties and Responsibilities :
1. CONTINUOUSLY monitor security events and logs from both cloud (e.g. Microsoft 365, Azure, AWS, Google Cloud and other cloud platforms) and on-premises systems using SIEM and log management tools to identify anomalies, suspicious activities, and indicators of compromise.
2. INVESTIGATE and analyse security alerts and incidents generated by SIEM and other monitoring platforms, performing triage to differentiate legitimate threats from benign or false-positive activity.
3. SERVE as a first responder to validated security incidents, executing containment and eradication steps in accordance with incident response playbooks established by CITO.
4. COLLABORATE with the Lead Information & Cybersecurity Officer and IT teams to coordinate response actions, remediation steps, and recovery activities following security incidents.
5. WORK with other cybersecurity personnel to develop and refine security orchestration, automation, and response (SOAR) playbooks within SIEM tools to streamline and automate repetitive incident response tasks.
6. CONFIGURE SIEM and SOAR workflows to rapidly address common threats, including automatic disruption or disabling of suspicious activity upon receiving high-severity alerts.
7. CONTINUOUSLY enhance detection and response capabilities by improving detection rules, correlation queries, analytic models, and playbook effectiveness to enhance both accuracy and response.
8. CONDUCT proactive threat hunting across enterprise environments using Kusto Query Language (KQL) and other analytical tools to uncover stealthy or unreported threats that may bypass automated detection.
9. ANALYZE anomalies in user behaviour, network traffic, and system logs, identifying patterns indicative of potential compromise and recommending mitigation actions as necessary.
10. UTILIZE detection and response technologies such as EDR and NDR to protect organizational devices, including workstations, servers, and mobile endpoints, network devices, from malware, ransomware, and advanced threats.
11. REVIEW and analyse logs from FortiAnalyzer and other network security tools, identifying signs of malicious activity such as abnormal outbound traffic, port scans, or intrusion attempts, and coordinate with network administrators to adjust firewall rules and access controls.
12. MONITOR Active Directory activity using ADAudit Plus or similar tools to detect misuse or suspicious behaviour, such as unauthorized privilege escalation, unexpected admin account creation, or repeated account lockouts, and assist in prompt remediation of AD-related security concerns.
13. PARTNER with IT support teams to deploy security patches, implement configuration hardening measures, and support compliance with NIST, CIS benchmarks, and CITO security policies to minimize vulnerabilities.
14. STAY current with emerging cyber threats, vulnerabilities, attack vectors, and malware campaigns; update detection queries, monitoring rules, and incident response processes based on new intelligence and proactively strengthen the organization' s defensive posture.
15. DESIGN and build SIEM and SOAR solutions to address emerging technology requirements.