Security Analyst-SecureWorks

Job Duties Act as primary liaison for daily operations between the Department and the Department s Managed Security Services Provider, SecureWorks, as assigned by the Department. Review current information security policies and processes to assist management with developing project goals, as assigned by the Department. Perform computer incident response within the scope and capabilities of the MSSP; assist with computer incident response originating from sources outside the scope of the MSSP, as assigned by the Department. Perform advanced-level analysis of security events and incidents reported by the MSSP and other monitoring platforms, as assigned by the Department. Assist the MSSP and Security Administration Team with the identification and integration of all Department information security-related logs, as assigned by the Department. Assist the MSSP and Security Administration Team in deploying and health monitoring of MSSP-specific endpoint agents across multiple physical and virtual IT platforms, as assigned by the Department. Assist the Security Administration Team in deploying and health monitoring of non-MSSP specific endpoint agents across multiple physical and virtual IT platforms, as assigned by the Department. Assist the MSSP and Security Administration Team in maintaining the health of MSSP-specific log collection and IDS/IPS physical and virtual appliances, as assigned by the Department. Assist with the continuous integration of all relevant Department data sources and systems, existing or new, into the MSSP and other SIEM and SOAR solutions, as assigned by the Department. Provide Department management with status reports on assigned project goals. Required Qualifications A minimum of 4 years working as a security analyst in an environment utilizing a Managed Security Services Provider (MSSP), preferably SecureWorks. A minimum of 4 years coordinating and conducting event collection, log management, and event management using Security Information & Event Management (SIEM) or other log management systems. A minimum of 4 years with identity monitoring activities using SIEM or other log management systems. A minimum of 4 years research and analysis of log sources utilized for security monitoring. A minimum of 4 years of experience configuring and monitoring IDS/IPS, log collectors, firewalls, load balancers, web gateways, and other network traffic physical and virtual appliances. A minimum of 4 years with endpoint deployment solutions to enable installation of security products and telemetry gathering on computer workstations and servers of varying operating systems and versions (e.g., SCCM, Altiris, KACE, Ivanti). A minimum of 4 years in Microsoft Active Directory on-premises and Azure (hybrid) administration, including practices of account provisioning, enable/disable/reset, and management of Organizational Units and Groups. NO Remote its a on-site position #J-18808-Ljbffr First Soft Solutions LLC