Minimum Qualifications and Experience
Security Operation Center L1
- Bachelor’s degree of Computer Science
- 1 – 2 years of experience as Security Operation Center L1
- Responsible for working in a 24×7. Page 4 of 14 Request For Proposal (RFP) Page 5 of 14
- Have min certification Splunk Power User and ECSA, CND or equivalent.
- Have knowledge of Security and Network
- Have knowledge concept cyber-attacks and techniques, threat vector, risk, and incident management
- Have knowledge of various operating system like Windows, Linux, Unix, etc
- Have knowledge about various SIEM Splunk and security perimeter device
Security Operation Center L2
- Bachelor’s degree of Computer Science
- Minimum 3 years experience in Cyber Security or at least 1-year of working as a L2 SOC
- Responsible for working in a 24×7
- Have min certification Splunk Power User, ECSA and ECIH or equivalent
- Have depth knowledge of Security and Network
- Have depth knowledge and concept cyber-attacks and techniques, threat vector, risk, and incident management
- Have good knowledge of various operating system like Windows, Linux, Unix
- Have good knowledge about various SIEM Splunk and Security Perimeter Device and Tools
- Have good Documentation and Reporting Incident
- Have experience Threat Hunting
- Have experience Regular Expression (Regex)
- Have experience create Splunk Dashboard, Use Case and Policy related with alert/issue/vulnerability and other security issue
- Have experience create knowledge base/Playbook/Guideline for investigation process and every SOC process activity
- Can performed evaluation false positive alert/issue/vulnerability
- Have good knowledge for develop and improve processes for monitoring and incident
- Have good Quality Incident Assessment
- Have experience for run vulnerability scanning and analysis the result
- Have experience and good for tracking and follow-up activity and incident base on SLA
- Participate in professional services (internal and external penetration testing, wireless assessments, web and mobile application assessments, firewall and server security audits, social engineering exercises, security awareness programs etc.)
- Have experience with threat intelligent platform for Perform threat intelligence analysis and investigations. Search on the dark web and use other platforms such as RF to identify intelligence indicators or threats for a specific client
