Cyber Security SOC Engineer - SC/DV CLEARED

Project overview

Cyber Security SOC Engineer - SC/DV CLEARED

An opportunity has arisen in the Cyber Security Operations Centre (SOC) within Digital Excellence (DEX) UK for a Cyber Security Engineer.

The successful applicant will lead on the technical aspects of ensuring cyber security appliance efficiency of tasks to support alert tuning, network visibility and log ingesting to relevant toolsets. They will advise on implementation of new tools and lead the updating and expansion of existing capabilities. Reporting to the Cyber Security Capability Manager, the Cyber Security Engineer will provide support by ensuring availability, readiness and resilience of cyber security tool sets within in scope environments.

Responsibilities

We are looking for a Cyber Security Engineer to support the Cyber Security Capability Manager in ensuring Digital Excellence UK meets the challenges and demands of countering the Cyber Threat the Client.

To work with other UK Cyber Security members, the role will cover Back End refresh, playbook Scripting and fault finding, Cyber Security tool upgrades, capability implementation, tool integration, data source on-boarding and investigation activity utilising a wide variety of security platforms including but not limited to; SIEM (Security Information Event Management), Network Packet Capture platform, Anti Malicious Code, Threat Detection technologies and platforms across the in-scope UK networks.

Skillset/Experience Required:

What's in it for you?:

• Accountable for the effective mapping and topology of SOC toolsets including integrations and feeds between solutions
• Enriching the visibility and optimisation of SOC tools through data modelling and tuning
• Maintain the primary SOC toolsets, ensuring their availability, functionality and optimisation
• Responsible for the daily muster and availability of all cyber security technologies within in-scope environments
• Responsible for the accurate tracking of product lifecycle and advising management of EOL/EOS roadmaps
• Support the Cyber Security Capability Manager in the coordination, planning and execution of SOC appliance upgrades
• To support all cyber security pillars with new capability implementation and integration to existing solutions
• Implement cyber security tool changes and configuration ensuring efficient reporting into CAB and control boards
• To lead on playbook Scripting activities ensuring they are well documented and tested. This includes fault finding and review of false positives
• To be the Subject Matter Expert (SME) on SOC connectivity and visibility across all in scope networks and infrastructure, ensuring connections and integrations are understood and documented with the Cyber Security Capability Manager
• To lead all activity of Back End refresh on cyber security appliances
• including certificate updates, patch releases and software updates
• Responsible for attending DEX CAB and collating all impacting activities on cyber security alerting
• Responsible for attending DEX Incident and Issue red teams in support of root cause analysis
• advising on cyber security changes which may impact other services
• Collaborate closely with DEX Back Office to maintain availability and efficiency of cyber security tools and recover any service outages or disruption
• Support the SOC in investigation activity utilising a wide variety of security platforms, creating custom searches, advanced queries or scripts in order to find the root cause or IOC of an alert.
• Strong coding and Scripting background
• PowerShell, Python & Regex
• Proven ability to work with APIs, including HTTP/S headers and responses, JSON Objects.
• Proven experience with Proxies administration and changes.
• Windows (SMB) and.Nix (NFS) remote storage.
• IIS (Windows Web Server) Configuration, Active Directory/LDAP (authentication).
• Experience with applying certificates, software updates and the steps involved for end-of-life refresh activity.
• Experience with VMware/Hyper-V Virtual machines and virtual switches.
• Experience in setting up, implementing and maintenance of cyber security tooling.
• Experience with the creation, testing and maintenance of AI or machine learning technologies to assist with the optimisation of work flows or play books.
• Experience with SIEM (Security Information Event Management) technologies.
• This is a great time to join the DEFENCE UK Cyber Security Department in a period of evolution and expansion.
• There are new capabilities being implemented and tested to ensure a robust Cyber Defence capability exists to counter the threats. This will require hands-on with the technologies to assist the analysts get the best from the toolset.
• The Cyber Security Engineer will be involved in all SOC projects existing and new from concept through analysis to installation giving you a 360-degree oversight of a capability and immersing yourself within a technical project.
• There will be opportunity to support the Senior analysts in their research and development of cyber technologies to ensure the best fit for our environments.

Project details

Stevenage

SECURITY CLEARANCE LEVEL: DV, could start on SC - UKEO

24+ Months Minimum

WORK PATTERN: Fully on site; 5 days a week, 08:00-17:00

£78.95 UMB- £92.11 UMB Hour Umbrella Inside IR35

As discussed, please find the below extra info about the Role.

Our client want someone who can build, maintain, integrate, troubleshoot and automate the security tools used by the SOC.

What does the client actually need?

In simple terms:

A hands-on Cyber Security/SOC Tooling Engineer who looks after the technology behind the SOC.

They need someone who can make sure security tools are:

This is more engineering/tooling than pure SOC monitoring.

What type of candidate should you imagine?

A good candidate might currently be:

Senior Cyber Security Engineer/SOC Engineer

working in a large enterprise.

They might spend their day:

maintaining SIEM ? onboarding logs ? writing Python/PowerShell scripts ? tuning alerts ? integrating security tools ? troubleshooting connectivity ? upgrading appliances ? managing certificates ? investigating security events.

That's your candidate.

The 5 most important things

Look for people who have implemented or maintained:

They don't necessarily need every product mentioned.

This is a major requirement.

They specifically want:

PowerShell + Python + Regex

The candidate should actually have used these for things such as:

A CV that simply says "Python" in a skills section isn't enough.

This is another major part.

Look for:

The person needs to understand how security tools communicate with each other.

They also want someone who understands the infrastructure underneath the security tooling:

This is why a pure SOC Analyst won't necessarily work.

They'll be responsible for:

So this person needs hands-on infrastructure/security engineering experience.

This is the Complete JD from the Client.

Essential Skillset & Tools

• connected
• receiving logs/data
• correctly configured
• patched and upgraded
• integrated with other systems
• generating useful alerts
• available and resilient
• automated where possible
• SOC Security Tooling
• SIEM
• EDR/XDR
• IDS/IPS
• Network monitoring
• Network Packet Capture
• Threat Detection platforms
• Malware/Anti-Malware tooling
• Scripting & Automation
• automation
• playbooks
• security tooling
• investigations
• custom queries
• log processing
• alert tuning
• Security Tool Integration
• APIs
• REST APIs
• HTTP/S
• JSON
• log ingestion
• data sources
• integrations
• connectors
• SIEM onboarding
• security platform integration
• Infrastructure Knowledge
• Windows
• Linux/Unix
• Active Directory
• LDAP
• IIS
• SMB
• NFS
• VMware
• Hyper-V
• virtual switches
• proxies
• certificates
• Security Tool Lifecycle/Upgrades
• patching
• software upgrades
• EOL/EOS
• appliance refresh
• configuration changes
• troubleshooting
• service recovery
• Strong coding and Scripting background
• PowerShell, Python & Regex
• Proven ability to work with APIs, including HTTP/S headers and responses, JSON Objects.
• Proven experience with Proxies administration and changes.
• Windows (SMB) and.Nix (NFS) remote storage.
• IIS (Windows Web Server) Configuration, Active Directory/LDAP (authentication).
• Experience with applying certificates, software updates and the steps involved for end-of-life refresh activity.
• Experience with VMware/Hyper-V Virtual machines and virtual switches.
• Experience in setting up, implementing and maintenance of cyber security tooling
• Start: ASAP
• Duration: 24+ Months
• Location: Stevenage, UK, GB