Level 3 SOC Analyst

Luxoft DXC Technology Company is an established company focusing on consulting and implementation of complex projects in the financial industry. At the interface been technology and business, we convince with our know-how, well-founded methodology and pleasure in success. As a reliable partner to our renowned customers, we support them in planning, designing and implementing the desired innovations. Together with the customer, we deliver top performance! For one of our clients in the Insurance Segment, we are searching for an extensively professional L3 SOC analyst/engineer working with MS Defender tool suite in Poland

The successful candidate will join the SOC team as a senior resource and execute on the following responsibilities:

• Operate as detection and response subject-matter expert, working with the CTO, Information Security and Group SOC
• Technical subject-matter expert in SOC/SIEM and supporting technologies (EDR, UEBA, etc.) to develop custom queries (e.g., KQL) and playbooks for the SOC analysts to utilize in their investigations.
• Drive the continuous development of detection capability across the IT estate.
• Align and maintain detection capability to the Mitre attack framework.
• Support the Threat hunters in executing complex data analysis.
• Perform root cause analysis of detection failures, identify areas for improvement.
• Manage, investigate and resolve complex issues with the Security tooling.
• Securely configure the SIEM, AV, UEBA and EDR solutions in accordance with relevant policy and regulation
• Provide a point of escalation for security detection technical service issues.
• Create and review/approve detection technology high and low level designs.
• Ensure the relevant security tools are compliant with company standards and governance.
• Contribute to existing Policy, procedures and process documentation enhancements
• Define and implement technical governance processes for security tooling including AV, EDR, Defender Cloud, SIEM and UEBA

MUST

L3 SOC Analyst (Detection and Response), SIEM and other supporting technologies expertise(Defender 365, Defender for Cloud and UEBA, etc.)

• Provide L3 incident investigation
• Create and refine runbooks/playbooks for all alerts
• on-board log sources and work on log issues
• Fine-tune EDR and other tooling to exclude noise and false positives
• Create and fine-tune content in SIEM - correlation rules, Dashboard and Reports etc
• Interact with SIEM, EDR and NDR vendors (TAC Support) to remediate any issues with tooling
• Evaluate new solutions for SOC
• Identify opportunities to improve overall capacity, playbook and runbook
• Understanding of threat landscapes and threat modelling, security threat and vulnerability management, and security monitoring
• Working knowledge of tools and techniques used by attackers to gain entry into corporate networks, including common IT system flaws and vulnerabilities.
• knowledge of industry standards such as ISO 27001, HIPAA, FedRAMP, Cloud Security Alliance, NIST frameworks and risk methodologies
• Demonstrated experience in communicating complex security concepts, both verbally and in writing, to a variety of audiences
• Must take ownership of tasks and demonstrate high degree of automony to ensure completion
• Must be personable and foster good stakeholder and peer group working relationships

NICE TO HAVE

• Knowledge of Machine Learning and big data ion regards to security incident detection would be beneficial
• Recognised Cyber Security certifications, such as CISSP, CIISEC (member or fellow), CISM, SANS, SABSA, OSCP are advantageous

Microsoft Security and compliance certifications such as SC-200, MS-500 and AZ-500 preferred "