Experienced SOC Analyst - N3

Project overview

CONTEXT

As part of the IT Operations & Services Department's activities, our client is looking for a Level 3 SOC Analyst to strengthen its Operational Security and Security Coordinators team within the IT department.

The mission aims to enhance the SOC's capabilities for detecting, investigating, and responding to security incidents.

The consultant will also support the IT department's teams in the continuous improvement of the security posture.

Missions

Take charge of security alerts and incidents escalated by Level 1 and 2 SOC analysts.

Ensure incident qualification, in-depth investigations, root cause analysis, and formulation of remediation recommendations.

Perform advanced analysis of Windows and Linux systems, workstations, and servers using CrowdStrike Falcon and Microsoft Defender EDR solutions.

Conduct proactive Threat Hunting activities based on hypotheses, threat intelligence (CTI), and the MITRE ATT&CK framework.

Improve detection rules, EDR policies, and SOC use cases, particularly by creating and adjusting rules to reduce false positives.

Participate in cyber crisis management and provide support for incident response activities.

Act as a cybersecurity expert and point of contact for infrastructure, workstation, network, application, and project teams.

Advise teams on system security, vulnerability and incident remediation, and the integration of security into projects.

Support the skill development of N1/N2 SOC analysts and IT department teams.

Ensure knowledge transfer and lead awareness and training sessions.

Produce indicators and dashboards related to SOC activity and EDR coverage.

Prepare for and participate in operational committees, steering committees, and security committees.

Present the threat landscape, significant incidents, and associated action plans.

Write and update security standards, policies, procedures, and guides.

Formalize and maintain SOC playbooks and operating procedures.

Required Technical Skills

CrowdStrike Falcon

Proficiency in Event Search and Advanced Event Search investigation features.

Proficiency in CQL or LogScale language.

Use of Real Time Response.

Management of prevention policies and exclusions.

Proficiency in Custom IOA.

Microsoft Defender for Endpoint

Proficiency in Advanced Hunting with KQL language.

Use of Live Response.

Proficiency in Automated Investigation & Response.

Configuration of security policies.

Integration into the Microsoft Defender XDR and Intune ecosystem.

In-depth knowledge of Windows and Linux environments.

Proficiency in Windows mechanisms: Active Directory, event logs, registry, and persistence mechanisms.

Memory and artifact analysis.

Performing forensic triage.

First-level malware analysis.

Design of detection and correlation rules.

Knowledge of SIEM solutions such as Microsoft Sentinel, Splunk, or QRadar.

Proficiency in KQL and SPL query languages.

Knowledge of Sigma and YARA.

Proficiency in the MITRE ATT&CK framework.

Knowledge of the Cyber Kill Chain.

Exploitation of cyber threat intelligence (CTI) and indicators of compromise (IOC).

Knowledge of common attack techniques: ransomware, lateral movement, and identity compromise.

Knowledge of NIST and SANS incident management methodologies.

Experience in incident response and cyber crisis management activities.

Appreciated Technical Skills

SOAR Automation.

PowerShell and Python scripting.

Security of Azure and Microsoft 365 environments.

Microsoft Entra ID security.

Governance and Documentation Skills

Ability to write security standards, policies, and procedures.

Knowledge of ANSSI guides and recommendations.

Knowledge of NIST CSF, NIS2, and DORA frameworks.

Ability to produce reporting and indicators adapted to operational and decision-making audiences.

Behavioral Skills

Ability to simplify cybersecurity issues and communicate security concepts to non-specialist technical teams and management.

Advisory posture, pedagogical approach, and skill transfer orientation.

Rigor and composure in crisis situations.

Synthesis skills, both written and oral.

Expected Deliverables

Investigation Reports: N3 incident investigation reports and Threat Hunting activities.

Detection and EDR: Detection rules and configuration recommendations for CrowdStrike Falcon and Microsoft Defender for Endpoint solutions.

SOC Reporting: Monthly SOC activity reports.

Governance: Committee support materials and minutes.

Security Documentation: Security standards, procedures, and playbooks.

INFO

• Security Analysis and Investigation – Level 3
• Support for IT Department Teams
• Reporting and Governance
• Documentation and Standardization
• EDR Solutions – Mandatory confirmed expertise
• System Analysis and Forensic Investigation
• Detection and SIEM
• Threat Analysis and Methodologies
• Incident Response and Crisis Management

Project details

PARIS

€400 Max

Contract Type: CDD/CDI (€2000-€4000)

Start Date: 01/07/2024

Profile Sought

Required Technical Skills

CrowdStrike Falcon

Proficiency in Event Search and Advanced Event Search investigation features.

Proficiency in CQL or LogScale language.

Use of Real Time Response.

Management of prevention policies and exclusions.

Proficiency in Custom IOA.

Microsoft Defender for Endpoint

Proficiency in Advanced Hunting with KQL language.

Use of Live Response.

Proficiency in Automated Investigation & Response.

Configuration of security policies.

Integration into the Microsoft Defender XDR and Intune ecosystem.

In-depth knowledge of Windows and Linux environments.

Proficiency in Windows mechanisms: Active Directory, event logs, registry, and persistence mechanisms.

Memory and artifact analysis.

Performing forensic triage.

First-level malware analysis.

Design of detection and correlation rules.

Knowledge of SIEM solutions such as Microsoft Sentinel, Splunk, or QRadar.

Proficiency in KQL and SPL query languages.

Knowledge of Sigma and YARA.

Proficiency in the MITRE ATT&CK framework.

Knowledge of the Cyber Kill Chain.

Exploitation of cyber threat intelligence (CTI) and indicators of compromise (IOC).

Knowledge of common attack techniques: ransomware, lateral movement, and identity compromise.

Knowledge of NIST and SANS incident management methodologies.

Experience in incident response and cyber crisis management activities.

Appreciated Technical Skills

SOAR Automation.

PowerShell and Python scripting.

Security of Azure and Microsoft 365 environments.

Microsoft Entra ID security.

Governance and Documentation Skills

Ability to write security standards, policies, and procedures.

Knowledge of ANSSI guides and recommendations.

Knowledge of NIST CSF, NIS2, and DORA frameworks.

Ability to produce reporting and indicators adapted to operational and decision-making audiences.

Behavioral Skills

Ability to simplify cybersecurity issues and communicate security concepts to non-specialist technical teams and management.

Advisory posture, pedagogical approach, and skill transfer orientation.

Rigor and composure in crisis situations.

Synthesis skills, both written and oral.

Work Environment

As part of the IT Operations & Services Department's activities, our client is looking for a Level 3 SOC Analyst to strengthen its Operational Security and Security Coordinators team within the IT department.

The mission aims to enhance the SOC's capabilities for detecting, investigating, and responding to security incidents.

The consultant will also support the IT department's teams in the continuous improvement of the security posture.

• EDR Solutions – Mandatory confirmed expertise
• System Analysis and Forensic Investigation
• Detection and SIEM
• Threat Analysis and Methodologies
• Incident Response and Crisis Management
• Start: ASAP
• Duration: 18 mois
• Remote: hybrid
• Location: Paris, France, FR
• Languages: French