Specialist, Cybersecurity - SOC

Provides governance and operational performance oversight of detect, respond, and recovery cybersecurity functions. The primary function is to govern and provide oversight to managed services SOC operations, ensuring effective threat detection, response, and continuous improvement across IT and OT environments. The role includes management of cybersecurity controls, platforms, tooling, and managed services related to threat management and incident detection, response, and recovery. Key responsibilities include incident governance, threat detection, threat intelligence, threat hunting, and managing and maintaining operational playbooks, metrics, exercises, and incident reporting. This role acts as the domain authority for cybersecurity operations related to cybersecurity incidents, and identifies, analyzes, communicates, contains, and recovers from cyber incidents as they occur. The role is responsible to run, manage, and maintain existing cybersecurity control platforms and tooling, as well as to plan and execute projects to improve existing solutions and to introduce new capabilities and controls in alignment with the department's strategy and roadmap. Job Responsibilities Service owner for managed security service provider performance, SLAs, and service quality across all capabilities related to cybersecurity threat detection, incident response, and recovery, including service reviews and overseeing SOC operations on a daily basis. Govern major incident response, including identification, containment, eradication, recovery, root cause identification, and post-incident reviews. Focal point for coordinating communications related to cybersecurity threats, events, incidents, and recovery activities. Escalation point for any issues with SOC-related services and controls. Define use cases, detection rules, and threat coverage priorities. Define standards and use cases for IT and OT log integrations with SOC operations. Manage and maintain log management and SIEM ingestion platforms and process. Manage and maintain SIEM use cases, standards, operational playbooks, and reporting. Ensure threat intel is operationalized into SOC processes. Review threat intel sources for integration. Deliver threat intelligence advisories and briefings to key stakeholders based on their areas of interest, such as OT threats to manufacturing cybersecurity focal points. Deliver executive reporting on incidents, trends, and risks. Deliver executive reporting on threats and state of cybersecurity internally, within the industry, and of interest to the business. Provide custom reports and dashboards to cybersecurity, IT, and OT stakeholders driven by cybersecurity log and SIEM tooling. Job Requirements Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or a related field. 5+ years of experience with regulatory compliance and information security management frameworks (such as International Organization for Standardization [ISO] 27000, COBIT, National Institute of Standards and Technology [NIST] 800) 8-10 years in SOC /Incident Response Strong understanding of SIEM, SOAR, EDR Strong decision-making capabilities, with a proven ability to weigh the relative costs and benefits of potential actions and identify the most appropriate one. An ability to effectively influence others to modify their opinions, plans or behaviors. An understanding of organizational mission, values, goals and consistent application of this knowledge. Strong problem-solving and troubleshooting skills. Knowledge of firewalls, intrusion detection systems, intrusion prevention systems, security information and event management (SIEM) systems, security orchestration, automation, and response (SOAR) platforms, and other security tools and technologies. #J-18808-Ljbffr Sabic Americas, Inc.