SOC Specialist_L3

Advanced Security Monitoring and Incident Response

• Lead the investigation and resolution of complex security incidents escalated by L1 and L2 SOC teams.
• Perform detailed analysis of security alerts, events, and logs to identify advanced threats and malicious activities.
• Conduct incident triage, root cause analysis, impact assessment, containment, eradication, and recovery.
• Investigate advanced persistent threats (APTs), ransomware, malware infections, insider threats, and account compromises.
• Coordinate incident response activities with IT infrastructure, network, cloud, endpoint, and application security teams.
• Develop detailed incident reports, executive summaries, and post-incident reviews.

2. IBM QRadar SIEM

• Administer and optimize IBM QRadar SIEM monitoring and detection capabilities.
• Develop, tune, and maintain QRadar correlation rules, building blocks, and custom rules.
• Investigate offenses by analyzing event and flow data, log sources, and correlated security events.
• Perform advanced searches using QRadar Ariel Query Language (AQL).
• Identify false positives and improve detection accuracy through rule tuning and offense prioritization.
• Onboard and troubleshoot log sources, DSM parsing, event categorization, and normalization.
• Develop dashboards, reports, and use cases aligned with MITRE ATT&CK techniques.
• Monitor QRadar health, event ingestion, EPS/FPM utilization, and data collection issues.

3. Splunk SIEM and Security Analytics

• Develop and optimize advanced Splunk Search Processing Language (SPL) queries for threat detection and investigation.
• Create and maintain correlation searches, alerts, dashboards, reports, and security use cases.
• Investigate suspicious activities using authentication, endpoint, network, DNS, proxy, firewall, and cloud logs.
• Develop detection content and scheduled searches using Splunk Enterprise Security where deployed.
• Tune detections to reduce false positives and improve alert fidelity.
• Troubleshoot data ingestion, sourcetypes, field extractions, parsing, indexing, and search performance.
• Leverage risk-based alerting, risk scores, and notable events where supported by the deployed Splunk ES configuration.
• Create reusable SPL searches for incident investigations, threat hunting, and forensic analysis.

4. Threat Hunting and Detection Engineering

• Conduct proactive threat hunting across SIEM, EDR, network, identity, and cloud telemetry.
• Map adversary behaviors and detections to the MITRE ATT&CK framework.
• Analyze indicators of compromise (IOCs), tactics, techniques, and procedures (TTPs).
• Develop and enhance detection rules based on emerging threats and threat intelligence.
• Perform hypothesis-driven investigations to identify stealthy or previously undetected threats.
• Validate detection coverage and recommend improvements to security monitoring.Role & responsibilities

Preferred candidate profile

• Bachelor's degree in Computer Science, Information Security, or a related field, or equivalent practical experience.
• Typically 58 years of experience in cybersecurity or SOC operations, including substantial hands-on incident response experience.
• Strong hands-on expertise in IBM QRadar and Splunk SIEM.
• Advanced knowledge of QRadar AQL and Splunk SPL.
• Strong understanding of Windows, Linux, Active Directory, DNS, HTTP/S, TCP/IP, VPNs, firewalls, proxies, and endpoint security.
• Experience investigating phishing, malware, ransomware, privilege escalation, lateral movement, and data exfiltration.
• Knowledge of MITRE ATT&CK, the Cyber Kill Chain, and incident response methodologies.
• Experience with EDR/XDR platforms, threat intelligence, and vulnerability