Security Analyst

Title

Security Analyst

Location

Remote anywhere in Canada

Start

As soon as possible.

Duration

6+ mois, renewable.

Description

The objectif is to correct and optimize the RSA NetWitness SIEM platform.

The selected candidate must be able to

• Take charge of correcting integrations and resolving anomalies;
• Optimize and enhance the current configuration;
• Add new incident detection models;
• Integrate new log sources;
• Improve the quality and relevance of security alerts.

Main responsibilities

• SIEM administration and management
• Manage log sources: add, integrate, normalize, validate feeds;
• Update parsers, feeds and detection content according to security needs;
• Ensure SIEM availability, performance and security.
• Continuous improvement and technology watch
• Monitor new threats, vulnerabilities and RSA functionalities;
• Propose and implement continuous improvements in detection, correlation and operational processes;
• Write technical documentation, procedures and integration guides.
• Event detection and correlation
• Optimize rule tuning to reduce false positives and improve relevance;
• Create and maintain effective correlation rules and alerts to detect anomalous behavior.
• Security Operations Support (SOC)
• Collaborate with SOC analysts for incident analysis and qualification;

Skills and Experience

The consultant must have

• Deployed, configured and maintained RSA NetWitness solutions;
• A minimum of 3 years' continuous experience on the platform.

Required Skills

• Excellent command of RSA NetWitness Platform (Logs, Packets, Endpoint, Orchestrator);
• Solid knowledge of networking, Windows/Linux systems and protocols (TCP/IP, DNS, HTTP, etc.);
• Expertise in cybersecurity, threat hunting, forensic and MITRE Telecommunication&CK;
• Demonstrated experience in log source integration (firewalls, EDR, IDS, application servers, etc.);
• Good understanding of SIEM/SOAR architectures and automation processes.