Senior SOC consultant

Key Responsibilities:

SOC Strategy & Optimization

• Assess and improve SOC operations, processes, workflows, and coverage.
• Define and enhance incident response procedures and playbooks.
• Conduct SOC maturity assessments and recommend improvements.

Threat Detection & Response

• Oversee and support analysis of complex security incidents and escalations.
• Develop, tune, and optimize SIEM detection use cases and correlation rules.
• Lead threat hunting initiatives and guide junior analysts.

Advisory & Client Engagement

• Work with stakeholders to align SOC services with business and regulatory requirements.
• Provide recommendations for compliance with standards such as NIST CSF, ISO 27001, GDPR, and local regulations.
• Conduct comprehensive MITRE ATT&CK based assessments to evaluate the organization's security posture against known adversary tactics, techniques, and procedures (TTPs).
• Map detection and response capabilities to the MITRE ATT&CK framework, identify gaps, and recommend enhancements.
• Perform detailed compromise assessments to identify indicators of compromise (IOCs), suspicious behaviors, and evidence of potential or active breaches.
• Utilize endpoint detection, log analysis, threat intelligence, and forensics tools to support compromise investigations.
• Develop assessment reports, remediation plans, and executive summaries based on findings.
• Collaborate with SOC, threat intelligence, and incident response teams to strengthen detection and response processes.
• Present technical findings to both technical and non-technical audiences.

SIEM/SOAR Implementation & Enhancement

• Design and enhance SIEM/SOAR architecture and rule sets (e.g., Splunk, QRadar, Sentinel, ArcSight).
• Recommend log source onboarding and log normalization best practices.
• Automate response workflows to improve SOC efficiency.

Team Mentoring & Knowledge Transfer

• Provide guidance, training, and mentorship to SOC Level 1 and Level 2 analysts.
• Lead tabletop exercises and post-incident reviews.
• Develop internal documentation and knowledge base content.

Requirements

Education & Experience

• Bachelor’s degree in Computer Science, Cybersecurity, Information Systems, or related field.
• Minimum 4+ years of experience in a SOC environment.
• Proven experience in incident response, threat detection, and SOC consulting.

Technical Skills

• Strong knowledge of SIEM tools (Splunk, Sentinel, QRadar, etc.).
• Familiarity with SOAR platforms (e.g., Palo Alto XSOAR, IBM Resilient).
• Deep understanding of cyber threats, TTPs, and frameworks like:
• MITRE ATT&CK
• Cyber Kill Chain
• CIS Controls
• NIST 800-61 / 800-53
• Proficiency in scripting and automation (Python, PowerShell, Bash, etc.) is a plus.

Certifications (Preferred but not mandatory)

• GIAC (GCIA, GCIH, GCFA, GCED)
• CISSP / CISM
• CEH / ECSA
• ISO 27001 LA or NIST-based certifications

Soft Skills:

• Excellent communication and report writing skills.
• Ability to lead and influence security teams and stakeholders.
• Strong analytical and critical thinking abilities.
• Client-facing and consultative mindset.

Key Deliverables (if Consultant Role):

• SOC maturity gap assessment reports.
• SIEM rule tuning and detection engineering documentation.
• Incident response plans and playbooks.
• Mitre Att&ck Assessment .
• Comprise assessment
• Configuration Harding Documents