Source description
About the role
Essential
2+ years of hands-on experience in a Security Operations Center (SOC), Managed Detection and Response (MDR) environment, or cybersecurity-focused IT role
Proficient in the use of endpoint and network security tools (e.g., EDR, IDS/IPS, malware detection platforms) with the ability to validate and triage complex alerts
Working knowledge of Windows operating systems (both workstation and server), with additional experience in Linux (Ubuntu, Debian, RedHat) or macOS environments
Ability to interpret and analyze Windows event logs and other telemetry data
Understanding of core network concepts including TCP/IP, protocols, routing, and traffic analysis
Demonstrated experience contributing to real-time incident response efforts and threat investigations
Exposure to threat hunting methodologies and an understanding of attacker behavior and patterns
Experience handling active threats, including containment, mitigation, and recovery efforts during security incidents
Familiar with techniques such as persistence, privilege escalation, lateral movement, and defense evasion, and able to identify these in real-world environments
Familiarity with common incident response workflows and security operations processes
Strong analytical thinking and troubleshooting skills, with attention to detail in investigations and case documentation
Excellent communication skills, with the ability to clearly explain findings to both technical and non-technical audiences
Customer-first mindset with professionalism and a focus on service excellence
Must thrive within a team environment as well as on an individual basis
Natural curiosity and willingness to learn in a fast-paced, ever-changing threat landscape
A passion for cybersecurity, continuous improvement, and staying current on threat trends
Bachelor’s degree in Information Technology, Computer Science, Cybersecurity or related field, or equivalent practical experience
Ability to communicate in English
Desirable
Familiarity with the MITRE ATT&CK framework and its application in detection and response
Experience working with SIEM platforms and managing enterprise security telemetry
Ability to write and interpret SQL queries for data analysis and investigation
Experience with OSQuery and scripting skills, particularly in PowerShell
Relevant and practical cybersecurity certifications (e.g., GSEC, GCIA, GCIH, PEN-200, Security Blue Team L1, TCM Academy SOC L1, or similar)
More at Sophos