SOC Manager

A bit about us:

Products include endpoint protection, email security and a cloud posture management platform. Cotter Labs protects more than 4,000 organisations, from regional hospitals to Fortune 500 manufacturers.

This is a new role. The team has doubled in size over the past year. The Information Security team runs a 24/7 SOC. We need someone who can work through an alert queue and tell which ones matter. You will join as an independent contractor on a long-term agreement. Payment is monthly in USD. Expect to work a schedule that overlaps with US Eastern business hours until about noon ET.

Responsibilities:

• Analyse reported phishing emails, check headers and URLs, and purge malicious messages.
• Report on security awareness training and phishing simulation results.
• Tune noisy detection rules with the security engineering team.
• Monitor and triage alerts in Splunk, Microsoft Sentinel, QRadar or Elastic SIEM.
• Check threat intelligence feeds and IOCs against our environment.
• Escalate confirmed incidents and follow the incident response plan.
• Investigate endpoint alerts in CrowdStrike Falcon, SentinelOne or Defender for Endpoint.

Skills and experience:

• 7+ years in an SOC, security analyst or IT security role.
• Ability to work shifts, including some nights, weekends or holidays as scheduled.
• Familiarity with the MITRE ATT&CK framework.
• Basic scripting in PowerShell or Python.

Pluses:

• KQL or SPL query writing.
• CySA+, GCIH, GCIA or BTL1 certification.
• Malware analysis in a sandbox.

Schedule: Day shift with one week of on-call every six weeks

Compensation and benefits:

• Paid time off.
• Flexible hours.
• Monthly payments via wire transfer or Wise.
• Annual rate review.

Duration: 3 months. Start: Immediately.

Demo job created on 11jobs for testing and demonstrations. It is not an actual opening at Cotter Labs.