Security Operations Centre Specialist

Requirements:

• Proven hands-on experience in SOC operations, security incident detection, analysis, and response;

• Strong experience identifying and mitigating various DoS/DDoS attack vectors, including SYN floods, UDP amplification, HTTP/HTTP2 floods, DNS reflection, and slow-and-low attacks;

• Practical experience with DDoS mitigation solutions such as Cloudflare, Akamai Prolexic, AWS Shield, Radware, Imperva, Arbor Networks, or similar WAF/Anti-DDoS technologies;

• Hands-on experience with SIEM platforms, including detection rule creation, configuration, tuning, and optimization;

• Practical experience working with EDR and DLP solutions, including security alert monitoring, investigation, and incident response;

• Experience securing cloud environments and investigating security incidents across AWS, Azure, and Google Workspace;

• Strong scripting and automation skills using Python, Bash, or PowerShell to improve SOC operations;

• Proven experience reducing False Positives and optimizing detection logic to improve alerting accuracy and operational efficiency;

• Solid understanding of network and system security, including TCP/IP, UDP, DNS, SSH, SSL/TLS, HTTP protocols, and common cyberattack techniques;

• Experience working with Windows and Linux/Unix operating systems;

• Practical Threat Hunting experience, including proactive identification of suspicious activities and potential security threats;

• Strong analytical and problem-solving skills, with a data-driven approach to security incident investigation.

Responsibilities:

• Manage and support daily SOC operations, including security incident analysis, triage, investigation, and response;

• Monitor security alerts, conduct proactive Threat Hunting, and determine appropriate incident response, mitigation, and recovery actions;

• Detect, analyze, and mitigate DoS/DDoS attacks across network, transport, and application layers (L3/L4/L7);

• Configure, maintain, and optimize SIEM, EDR, DLP, and DDoS protection solutions, including detection rules, alerting policies, and rate-limiting configurations;

• Continuously improve detection accuracy by reducing False Positives and optimizing security monitoring processes;

• Monitor cloud environments, including AWS, Azure, and Google Workspace, to identify, investigate, and respond to security threats;

• Develop and implement automation scripts and workflows to streamline SOC operations, incident response, and routine security tasks;

• Investigate security incidents, document findings, prepare reports, and provide recommendations to prevent recurring threats;

• Conduct security assessments of newly introduced systems, applications, and cloud/on-premises infrastructure to ensure compliance with security standards and internal policies;

• Collaborate with IT, Infrastructure, and Security teams to improve threat detection, strengthen security controls, and enhance the organization's overall security posture.