SOC Engineer - ElasticSearch Specialist Proficient

3 yoe as L1 SOC Engineer, with working knowledge of ElasticSearch

Act as a first responder, L1 SOC Engineer is responsible for monitoring security tool in the SIEM, validate that the tools are working properly and respond to security events according with the alert's priority and risk.

Main responsibilities and tasks:

- Asset discovery.

- Monitor security tools in search of alerts.

- Follow SOP to address the security events.

- Discard false positives

- Suggest exclusions to avoid false positives, tunning of alarms and correlation rules to the security engineer.

- Prioritize security events based on the fast impact triage method.

- Escalate the security events in case they are not a false positive.

- Participate in purple team activities.

- Monitoring and managing alerts in Elastic Security SIEM, including detection rule optimization.

- Advanced or basic alert tuning (depending on specialist role experience), adjusting thresholds and filters to reduce false positives.

- Automation of processes using Elastic Stack (Elasticsearch, Logstash, Kibana, Beats) and additional tools such as ElastAlert or Watcher.

- Add sources to Elastic Search

- Development of advanced dashboards and visualizations in Kibana to enhance event correlation.

- Security alert investigation and generation of incident reports based on log analysis.

- Optimization of Elasticsearch queries to improve search and correlation performance.

- Support in managing the Elastic Stack, including configuring data pipelines.

- Collaboration with the SOC team to improve monitoring and incident response efficiency.

?Inglés Avanzado