SIEM/SOAR Content Developer| 12 Months (Inside IR35)| Hybrid (Glasgow)

Harvey Nash's Client is recruiting for a SIEM/SOAR Content Developer on a 12 month contract.

Main Responsibilities

  • You will join a team of technologists and cyber-security professionals that are dedicated to improving the coverage, quality and automation of cyber-security detection and response
  • Develop playbooks and automation in SOAR with analysts to improve efficiency of the SOC.
  • Develop analytics in Splunk (SPL) or Elastic Search (EQL) to detect actionable security alerts.
  • Design and develop integrations to connect to internal and external services.
  • Work alongside incident response analysts to automate the response to security incidents and improve security response coverage.
  • Perform analysis of security posture including recommending improvements to controls and processes.
  • Automate auxiliary team processes with SOAR playbooks.
  • Monitor and support SIEM and SOAR platforms to ensure security and stability of SOC infrastructure.

Key Skills

  • Cyber Response Platforms is looking for an experienced (5+ years) cyber-security professional to join their team as a SIEM/SOAR content developer.
  • Our ideal candidate has hands-on experience in computer network defence working either in or for a Security Operations Center or Cyber Incident Response Team.
  • Minimum of 3 years of experience in cyber detection engineering or incident response
  • Minimum of 1 year of experience developing automations in SOAR
  • Experience in the creation and management of detection logic in SIEMs (e.g Splunk, ArcSight, Microsoft Sentinel)
  • Intermediate experience developing scripts in Python
  • Strong knowledge of exploitation techniques (e.g. MITRE ATT&CK) and use-case development
  • Thorough TCP/IP and protocol experience (OSI L2-L7, DNS, HTTP, REST, SOAP)
  • Strong communication, task management and organizational skills
  • Highly experienced with Unix/Linux command-line tools and shell scripting

This role falls inside of IR35 and is hybrid working with the expectation to attend the Glasgow office 2/3 days a week. Please note that for this role you must have or be happy to get a Basic Disclosure Scotland. To apply, please send your CV using the link.

Apply