About this role
Daily Duties / Responsibilities:
PREFERENCE WILL BE GIVEN TO A CANDIDATE WHO CAN WORK ONSITE OVER HYBRID AND
OVER FULL-TIME REMOTE (ON-SITE AS NEEDED).
- Continuously review and correlate security event data across SIEM, EDR, IDS/IPS, and
threat intelligence sources to identify complex attack patterns, emerging threats, and security incidents.
-
Perform deep-dive analysis of suspicious activity, validate incidents, determine root cause and impact, and escalate critical incidents with detailed context to Tier 3 as required.
-
Create detailed incident reports, timelines, and post-incident summaries; contribute
to lessons-learned documentation and recommendations for remediation and preventative measures.
- Investigate user-reported phishing, malware infections, and potential policy
violations; advise users and internal/external teams on containment and recovery actions.
-
Recommend updates to SOC playbooks and workflows based on real-world INVESTIGATIONS, fine-tune detection rules. Alert thresholds, and correlation logic to reduce false positives and improve threat coverage.
-
Collaborate with engineering teams to ensure monitoring tools are properly configured and tuned. Integrate new threat intelligence feeds into workflows and proactively hunt for threats using up-to date tactics, techniques, and procedures (TTPs)
-
Serve as a customer-facing SME, “selling” the value of DIS services by demonstrating capabilities and resolving issues.
-
Document processes, runbooks, and troubleshooting steps related to SOC operations.
-
Coordinate with engineering, SOC, and agency staff as needed to meet goals.
-
Other duties as needed.
Required Skills (rank in order of Importance):
-
2+ Years of Experience with Security Monitoring and Incident Response.
-
2+ Years of Experience with MITRE ATT&CK framework.
-
2+ Years of Experience with dashboard creation and reporting.
Preferred Skills (rank in order of Importance):
-
Experience with the Palo Alto Cortex XSIAM/XDR platform.
-
Knowledge of Linux, network administration and network design.
-
Experience in administration of firewalls, VPN technology, Active Directory, Intrusion Detection/Prevention systems.
-
Candidate is local to Columbia, SC or surrounding city in South Carolina
Required Education/Certifications:
-
Associate’s degree in an information technology or information security related field
-
Four years of relevant work experience may be substituted in lieu of education
-
Two years of experience in supporting large soc operations
PREFERENCE WILL BE GIVEN TO A CANDIDATE WHO CAN WORK ONSITE OVER HYBRID AND
OVER FULL-TIME REMOTE (ON-SITE AS NEEDED).
- Continuously review and correlate security event data across SIEM, EDR, IDS/IPS, and
threat intelligence sources to identify complex attack patterns, emerging threats, and
security incidents.
- Perform deep-dive analysis of suspicious activity, validate incidents, determine root
cause and impact, and escalate critical incidents with detailed context to Tier 3 as
required.
- Create detailed incident reports, timelines, and post-incident summaries; contribute
to lessons-learned documentation and recommendations for remediation and
preventative measures.
- Investigate user-reported phishing, malware infections, and potential policy
violations; advise users and internal/external teams on containment and recovery
actions.
- Recommend updates to SOC playbooks and workflows based on real-world
INVESTIGATIONS, fine-tune detection rules. Alert thresholds, and correlation logic to
reduce false positives and improve threat coverage.
- Collaborate with engineering teams to ensure monitoring tools are properly
configured and tuned. Integrate new threat intelligence feeds into workflows and
proactively hunt for threats using up-to date tactics, techniques, and procedures
(TTPs)
- Serve as a customer-facing SME, “selling” the value of DIS services by demonstrating
capabilities and resolving issues.
-
Document processes, runbooks, and troubleshooting steps related to SOC operations.
-
Coordinate with engineering, SOC, and agency staff as needed to meet goals.
-
Other duties as needed.
Required Skills (rank in order of
Importance):
- 2+ Years of Experience with Security
Monitoring and Incident Response.
- 2+ Years of Experience with MITRE
ATT&CK framework.
- 2+ Years of Experience with
dashboard creation and reporting.
Preferred Skills (rank in order of
Importance):
- Experience with the Palo Alto Cortex
XSIAM/XDR platform.
- Knowledge of Linux, network
administration and network design.
- Experience in administration of
firewalls, VPN technology, Active
Directory, Intrusion
Detection/Prevention systems.
- Candidate is local to Columbia, SC or
surrounding city in South Carolina
Required Education/Certifications:
- Associate’s degree in an information
technology or information security
related field
- Four years of relevant work
experience may be substituted in lieu
of education
- Two years of experience in
supporting large soc operations.
Preferred Education/Certifications:
- CISSP, CISA, CISO or equivalent
advanced security certification.
- Additional relevant certifications
(e.g., CEH, OSCP, GPEN).
- Vendor certifications related to
information security.
Interview Process (phone, video or in-
person, how many rounds of i/v’s, etc)?
Initial round of interviews on Microsoft
Teams (on camera) with in-person interviews
Preferred before final selection
Interview Availability: How soon can you
schedule an interview (date / times)?
ASAP after posting closes and resumes are
received and reviewed