IT Security Operation Center L1 & L2  

Security Operation Center L1

• Monitor security alerts and events from various sources such as SIEM (Security Information and Event Management) systems, intrusion detection systems, and firewalls
• Perform initial analysis of security incidents and escalate to higher-level analysts when necessary
• Follow established procedures to investigate and document security incidents
• Maintain and update incident records in the ticketing system
• Provide timely and accurate communication regarding security incidents to stakeholders
• Assist in the identification and implementation of improvements to security monitoring processes and procedures
• Participate in routine SOC operations and shift coverage as required
• Stay current with the latest security trends and threats to enhance detection capabilities

Security Operation Center L2

• Conduct detailed analysis and investigation of escalated security incidents to determine their nature and impact
• Develop and implement incident response procedures and coordinate responses to significant security events
• Perform forensic analysis on compromised systems to identify indicators of compromise and assess the extent of damage
• Collaborate with other IT and security teams to address and remediate security incidents
• Generate detailed reports and documentation on incidents, including root cause analysis and recommendations for future prevention
• Provide guidance and training to SOC Level 1 Analysts
• Participate in the development and refinement of SOC processes, procedures, and playbooks
• Stay informed about emerging threats and vulnerabilities to enhance the SOC's defensive capabilities.

Security Operation Center L1

• Bachelor's degree of Computer Science
• 1 - 2 years of experience as Security Operation Center L1
• Responsible for working in a 24x7. Page 4 of 14 Request For Proposal (RFP) Page 5 of 14
• Have min certification Splunk Power User and ECSA, CND or equivalent.
• Have knowledge of Security and Network
• Have knowledge concept cyber-attacks and techniques, threat vector, risk, and incident management
• Have knowledge of various operating system like Windows, Linux, Unix, etc
• Have knowledge about various SIEM Splunk and security perimeter device

Security Operation Center L2

• Bachelor's degree of Computer Science
• Minimum 3 years experience in Cyber Security or at least 1-year of working as a L2 SOC
• Responsible for working in a 24x7
• Have min certification Splunk Power User, ECSA and ECIH or equivalent
• Have depth knowledge of Security and Network
• Have depth knowledge and concept cyber-attacks and techniques, threat vector, risk, and incident management
• Have good knowledge of various operating system like Windows, Linux, Unix
• Have good knowledge about various SIEM Splunk and Security Perimeter Device and Tools
• Have good Documentation and Reporting Incident
• Have experience Threat Hunting
• Have experience Regular Expression (Regex)
• Have experience create Splunk Dashboard, Use Case and Policy related with alert/issue/vulnerability and other security issue
• Have experience create knowledge base/Playbook/Guideline for investigation process and every SOC process activity
• Can performed evaluation false positive alert/issue/vulnerability
• Have good knowledge for develop and improve processes for monitoring and incident
• Have good Quality Incident Assessment
• Have experience for run vulnerability scanning and analysis the result
• Have experience and good for tracking and follow-up activity and incident base on SLA
• Participate in professional services (internal and external penetration testing, wireless assessments, web and mobile application assessments, firewall and server security audits, social engineering exercises, security awareness programs etc.)
• Have experience with threat intelligent platform for Perform threat intelligence analysis and investigations. Search on the dark web and use other platforms such as RF to identify intelligence indicators or threats for a specific client