SOC Analyst ( Tier 2 ) (Bengaluru)

The Opportunity As the SOC Analyst Tier 2 you will be responsible for monitoring, detecting, containing, and remediating security incidents utilizing a suite of security software tools. This critical role supports the internal JLR SOC and directing an outsourced tier 1 2 SOC MSSP to deliver robust security operations. Key Performance Indicators - Number of identified vulnerabilities - Number of vulnerabilities contained - Number of vulnerabilities mitigated - Time to detect - Time to respond - Time to mitigate Key Responsibilities: - Manage a suite of Security Products. - Evaluates incidents identified by tier 1 analysts - Uses threat intelligence such as updated rules and Indicators of Compromise (IOCs) to pinpoint affected systems and the extent of the attack. - Consolidating data from alert triage to provide context necessary to initiate Tier-3 work - Conduct security research and intelligence gathering on emerging threats - Can offer SME advice to security driven projects. - Ability to provide technical and service leadership to T1 analysts - Good understanding of ITIL processes, including Change Management, Incident Management and Problem Management. - Contribute to Incident Response investigations working with the Incident Response team. - Continual development of analysis playbooks and tradecraft - Proactively contribute to SOC strategy by refining standards, processes and procedures. - Handle incidents across Windows, Mac, and Linux platforms. - Develop and improve processes for incident detection and the execution of countermeasures. - Actively maintains awareness of developments in the intrusion analysis, incident response and information security fields. - Maintaining SecOps documentation. - Conduct proactive threat research Key Interactions - External Security Operations Centre (currently TCS) - Manufacturing - Engineering - Data Protection Officer / Legal - Business Protection - Other IT functions - GDPR Knowledge, Skills and Experience Essential - Experience working within a SOC / NOC environment - Experience in handling incident response for large organizations - Experience in NextGen EPP and EDR such as SentinelOne - Background in Vulnerability Management such as Qualys - Customer-oriented, flexible and demonstrated tendency to go above and beyond - Ability to communicate efficiently with clients and internal team members at all levels and across functional and organizational boundaries. - Comfortable working against deadlines in a fast-paced environment. - TCP/IP Networking - Familiarity with common IDS/IPS and Firewalls - Incident handling/response. - Some out of hours work may be required to support incidents and investigations - Problem solving skills and ability to work under pressure - Engineering experience supporting the following technologies: - Tibco logging management. - SIEM technologies (Exabeam & LogRhythm) - McAtee ePO Desirable: - Qualifications: - CEH - CompTIA CySA+ - GSEC - SSCP - CISSP - ITIL - Experience of network-based User Behaviour Analytics (DarkTrace, ArcSight User Behaviour Analytics etc) - Experience of security assessment and penetration testing tools - Experience of packet-capture tools and analysis of packet flows Personal Profile Essential: - An individual with a customer first mindset who is easy to do business with and makes people feel special, driven to deliver experiences that are personalised, transparent and dependable. - An individual who is results driven, demonstrates, tenacity, drive and perseverance, with the ability to deliver in a complex, highly demanding environment. - An individual with the ability to combine a short term, pragmatic focus with longer term planning - An individual who is resilient, energetic and enthusiastic, able to deliver results under pressure, whilst responding constructively to challenging recent ideas and inputs - An individual who can challenge existing thinking in a positive way whilst building credibility and trust through experience and personal style - A good communicator who can communicate complex ideas - An effective team player, actively leads, develops and supports team members Desirable: - An individual who enables speed in decision making through establishing alignment, clarity, appropriate resources and sense of urgency whilst bringing others along. The Opportunity As the SOC Analyst Tier 2 you will be responsible for monitoring, detecting, containing, and remediating security incidents utilizing a suite of security software tools. This critical role supports the internal JLR SOC and directing an outsourced tier 1 2 SOC MSSP to deliver robust security operations. Key Performance Indicators - Number of identified vulnerabilities - Number of vulnerabilities contained - Number of vulnerabilities mitigated - Time to detect - Time to respond - Time to mitigate Key Responsibilities: - Manage a suite of Security Products. - Evaluates incidents identified by tier 1 analysts - Uses threat int