SOC Technology Engineer
On-site Cairo, Cairo Governorate, Egypt 0036
Description
1. Manage, verify, validate and tune data collection for log continuity and act to solve any log continuity problem to ensure incidents are identified and alerted and maintain the integrity and availability of all the collected logs, along with monitoring log sources heart-beat.
2. Configure and manage performance & capacity monitoring and tuning of SOC technologies to maintain operational readiness.
3. Gather technical data, review security policy and configuration to keep up-to-date and efficient the overall Security Operations Center (SOC) infrastructure to maintain the Service Level Agreement (SLA).
4. Manage user access including user and group permissions updates for all SOC infrastructure solutions to ensure confidentiality of the logs and collected data.
5. Generate System performance reports as required by SOC management teams in alignment with the SOC governance to be used for further analysis.
6. Maintain SOC tools and technologies hardening to mitigate any known vulnerabilities on the different platforms.
7. Administrate and Maintain File Integrity Monitoring solution to identify any unauthorised changes to files in different systems and platforms, along with deploying software agents over infrastructure.
8. Administrate and maintain Database Monitoring solution, to identify unauthorised access/change to all databases under monitoring.
9. Administrate and maintain Firewall Monitoring solution, to identify unauthorized or weak firewall access policies to all integrated firewalls.
10. Integrate and maintain network traffic, security events and logs for Intrusion Detection Systems (IDS/IPS), Firewalls/Next-generation Firewalls, Email Security Gateways, File integrity monitoring, DB Monitoring, Proxy solutions, Windows Event Logs, AIX/Linux systems logs, Application Logs, Endpoint security solutions, Data Leakage prevention solutions to provide better data correlation and identify complex security incidents and threats in addition to implementing and integrating new security tools and systems in support of SOC needs.
11. Deploy and tune SIEM Use Cases and Rules, to reduce false positives on identified threats.
12. Maintain out-of-the-box and costumed SIEM connectors to ensure proper log collection, normalization, parsing, filtering, field-mapping and forwarding of event logs., and maintain developed scripts to automate SIEM log collection.
13. Manage SIEM online logs and archive solution for log retention and compliance, Integrate SOC log sources by deploying SIEM log collectors, develop scripts to automate SIEM log collection.
14. Follow all relevant department policies, processes, standard operating procedures and instructions so that work is carried out in a controlled and consistent manner.
15. Follow the day-to-day operations related to own jobs in the to ensure continuity of work.
Requirements
§ Bachelor’s degree of Engineering, Computer Science or equivalent.
§ Minimum 0 – 2 years of experience in IT Security and related disciplines.
§ Security engineering experience in mid-sized to large organizations, with emphasis on security operations, incident management, intrusion detection, firewall deployment and security event analysis.
§ Experience in following security technologies:
o Host and perimeter firewalls / Next-generation Firewalls
o Host and network intrusion detection concepts
o Logging and monitoring tools
o Antivirus or end-point security (EPP)
o Data loss prevention (DLP)
o Privileged access management (PAM)
o Endpoint Detection and Response (EDR)
o Security Automation, Orchestration and Response (SOAR)
o Identity and access management (IAM)
o Database access monitoring (DAM)
o Netflow/sflow
o Vulnerability scanning
o Network full packet capture
§ Recommended Certifications:
o SIEM Vendor Related Certificates
o GIAC Information Security Fundamentals
o CCNP Security
Skills:
§ Very good command of English and Arabic language
§ Good communication skills
§ Good Analytical skills
