Key Responsibilities Security Monitoring & Incident Analysis and Response - Monitor security events and alerts generated from SIEM, EDR, NDR, IDS/IPS, firewalls, and other security technologies.
- Perform 24x7 security monitoring and threat detection activities.
- Analyze security logs and identify suspicious activities, attack patterns, and potential threats.
- Validate alerts and distinguish true positives from false positives.
- Participate in threat hunting activities and proactive investigations.
- Investigate cybersecurity incidents and conduct root cause analysis.
- Assess the scope, impact, severity, and business risk of security incidents.
- Lead or support incident response activities including containment, eradication, recovery, and post-incident analysis.
- Develop incident reports, investigation findings, and executive summaries.
- Follow established incident response procedures, playbooks, and SOPs.
SIEM and SOAR Platform Administration - Manage and maintain SIEM and SOAR platforms and associated security monitoring tools.
- Configure and optimize log collection, parsing, normalization, and correlation rules.
- Ensure security logs are properly onboarded and monitored.
- Troubleshoot log ingestion and data quality issues.
- Improve monitoring coverage and visibility across enterprise environments.
- Design, develop, and maintain SIEM use cases and correlation rules.
- Create new detection content based on emerging threats, threat intelligence, and attack techniques.
- Continuously optimize detection rules to improve accuracy and reduce false positives.
- Map detection use cases to the MITRE ATT&CK framework.
- Develop and maintain security monitoring documentation and operational runbooks.
Collaboration & Communication - Coordinate with IT, infrastructure, application, cloud, and business teams during incident investigations.
- Facilitate communication between stakeholders during security incidents.
- Provide technical guidance and recommendations on security remediation actions.
- Present investigation findings and security recommendations to management.
- Support security awareness programs, tabletop exercises, and incident response drills.
Qualifications • Bachelor's degree in computer science, information security, or related technical discipline or equivalent professional experience related to Cybersecurity, Incident Response or information security. Relevant security-related certifications a plus : CISSP, CISP, CEH, Security+ etc.
• 3+ years of Security Operations Center (SOC) work experience with a Bachelor's degree
• 5+ years of related experience in Cybersecurity or computer network defense role.
• Proven subject matter ability in relevant areas, such as incident response, intrusion analysis, malware analysis, web application security or security engineering.
• Solid understanding of TCP/IP and internetworking technology including packet analysis, routing and network security defenses.
• Strong knowledge of operating systems (Windows & Linux), network services and applications, malware families and network attack vectors.
• Demonstrated experience in an enterprise-level incident response team or security operations center. Direct experience in handling cyber security incidents and associated incident response tools.
• Experience in operating and utilizing Security Information and Event Management and SOAR tools .Relevant tools experience is plus: MS sentinel, CP4S etc.
• Strong working knowledge of common security tools such as SIEM, AV, WAF, IDS, Netflow, Packet Analyzer and Endpoint Detection & Response tools.
• Experience in SIEM and SOAR administration, Log onboarding and integration, Correlation rule development, Use case design and implementation, security Automation.
• Display great problem solving skills, with tenacity and resilience to resolve issues.
• Excellent communication and presentation skills with proven skill in presenting analytical data effectively to varied audiences.
• Strong interpersonal and leadership skills to influence and build credibility as a peer.
• Strong understanding of cloud technologies and related security best practices.
这对我有什么好处? - 从事有意义的工作,保护系统运营和客户免受真实威胁
- 通过认证专业培训和导师指导机会实现职业发展
- 协作文化,你的专业知识直接影响安全策略
- 旨在支持平衡和身心健康的灵活工作选择
将你的网络安全专业知识带到一个重视你影响力的团队--立即申请!
为您量身打造的回报
我们的全方位奖励体现了我们对您的重视这不仅是薪酬和福利-it是对您的重要投资该方案旨在支持您的表现成长安全感和潜能提升它帮助您照顾自己和家人规划未来提升技能与职业发展在包容的环境中协作并为社区作出贡献在施耐德电气我们始终关注对您最重要的事情欢迎访问我们的 职业发展页面 了解更多
* 不同国家和地区可能适用不同的计划与项目
你是否渴望让自己的职业生涯产生深远影响？ 当你考虑加入一个新团队时企业文化至关重要在施耐德电气我们的价值观与行为准则是构建卓越文化助力业务成功的基石我们坚信"IMPACT" 核心价值观-- 包容Inclusion精进Mastery使命Purpose力行Action求知Curiosity共赢Teamwork-- 源于每一位成员的践行 "IMPACT" 更是我们向你的诚挚邀约无论你身处何种岗位都能在施耐德电气将可持续发展的愿景转化为实际行动这是一份号召邀请你将个人职业发展与创造更具韧性更高效率更可持续的世界这一宏伟目标紧密相连 我们正在寻找"影响力创造者"IMPACT Makers-- 那些能在自动化电气化与数字化的交汇点将可持续发展愿景转化为切实行动的杰出人才我们推崇每一位"影响力创造者"并相信每个人都有潜力成为其中一员 加入施耐德电气成为"影响力创造者"-- 即刻申请！ 全球营收达 400 亿欧元 有机增长率超 9% 业务遍及 100 多个国家和地区员工超 15 万人 申请须知 所有岗位均需通过线上申请方可纳入考量本岗位招聘将持续至合适人选到岗为止 多元化与包容性承诺 施耐德电气致力于成为全球最具包容性与人文关怀的企业我们为世界各地的每一个人提供公平的机会确保所有员工都能感受到独特的价值认同在安全的环境中全力以赴贡献所长我们珍视并反映所运营社区的多元性"包容" 是我们的核心价值观之一我们坚信个体的差异能让企业与个人变得更加强大我们承诺在一切工作中积极倡导包容性 道德与合规准则 在施耐德电气我们坚守最高标准的道德与合规要求并坚信信任是核心价值基石《信任宪章》Trust Charter是我们的行为准则彰显了我们在道德安全可持续发展质量及网络安全方面的坚定承诺为我们业务的方方面面提供支撑也体现了我们尊重他人真诚对待所有利益相关方的意愿你可通过此处了解更多关于《信任宪章》的信息 平等就业机会声明 施耐德电气是一家倡导平等就业机会的雇主我们的政策是在招聘录用培训调动及晋升等各个环节为所有符合条件的个人提供平等的就业及发展机会不因种族宗教肤色性别残疾国籍血统年龄军籍性取向婚姻状况或任何其他受法律保护的特征或行为而产生歧视
