SCOPE OF SERVICES
Perform critical functions within the Threat Management discipline, including staffing 24x7x365 coverage at the Citys Security Operations Center (SOC). This involves augmenting FTE shift schedules covering days, nights, weekends, and holidays. Interface with OTI Cyber Command teams internally, as well as with City agencies, vendors, and information-sharing partners. Monitor City networks and security alerts for intrusion, attempted compromise, and anomalous behavior; apply mitigation techniques or escalate as necessary; correlate threat intelligence across various logs collected by established security controls. Produce routine SOC metrics and reports. Maintain situation reports (SITREPS). Perform weekly quality control checks. Work closely with the SOC Director on incident preparation, including the ongoing development of new SOC playbooks and runbooks. MANDATORY SKILLS/EXPERIENCE
Note: Candidates lacking these skills will not be considered.
- Minimum 8 years of experience in Threat Management, SOC, or Incident Response environments.
- For senior positions, leadership includes the ability to lead and mentor junior analysts, coordinate team activities, and manage SOC operations effectively.
- Prior experience working in a SOC environment is mandatory, including familiarity with SOC operations, procedures, and tools such as SIEM (Security Information and Event Management) systems, intrusion detection/prevention systems (IDS/IPS), and endpoint detection and response (EDR) tools.
DESIRABLE SKILLS/EXPERIENCE
- Knowledge of cybersecurity principles, practices, and procedures.
- Strong understanding of network and host technologies.
- Experience applying techniques for detecting host and network-based intrusions using IDS methods and technologies.
- Experience with SIEM technologies, malware analysis, and mitigation techniques.
- Ability to apply cybersecurity and privacy principles to organizational requirements (confidentiality, integrity, availability, authentication, non-repudiation).
- Interpret information collected by diagnostic network tools (Netflow, security event logs, IDS systems, etc.).
- Ability to investigate and solve complex problems.
- Excellent communication skills for effectively conveying security incidents, risks, and recommendations to both technical and non-technical stakeholders, including the SOC Director and senior management.
- Threat Hunting: Proactive capabilities to identify and investigate potential security threats or anomalies before escalation.
- Incident Response: Experience in procedures and methodologies for analyzing, containing, mitigating, and recovering from security breaches.
#J-18808-Ljbffr