Cloud Security Operations Analyst

As a Cloud Security Operations Analyst you will be tasked with the critical role of supporting the day to day management of robust Azure Cloud infrastructure solutions, with a particular focus on supporting the infrastructure for a Microsoft Sentinel and Microsoft Defender XDR implementation on behalf of a SOC and CIRT team. Your expertise in Microsoft Sentinel will be pivotal as you navigate through the complexities of managing the requirements from our stakeholders and translating those into actionable infrastructure tasks.

To excel in this role, you should bring a wealth of experience in operating a complex SIEM solutions at an enterprise level. Your background should demonstrate a successful track record of working in a cross team matrixed environment to operate and support the infrastructure for comprehensive SIEM solutions. Your ability to communicate effectively and translate technical requirements into actionable strategies will be key to your success.

The work:

• Leverage native Microsoft Azure technologies including Azure Sentinel, Defender XDR, Azure Log Analytics, Azure Monitor, and Azure Policy to support an 800-171 compliant SIEM environment


• Operations and support of the SIEM solution itself, requiring hands-on experience with Sentinel Data Connectors, both native and custom


• Manage, maintain, and operate an Enterprise Level SIEM solution for AFS IT, ensuring its effectiveness and efficiency


• Work collaboratively with Application Owners, the Security Operations Center (SOC), the Computer Incident Response Team (CIRT), and other stakeholders will be vital in developing and maintaining this SIEM solution


•  

Here's what you need:

• US Citizen


• 1+ year hands on experience managing, maintaining, and operating Microsoft Sentinel and Microsoft Defender XDR


• 1+ year experience operating a Linux SYSLOG solution


• 1+ year experience with Infra as Code (IaC) (ARM, Bicep, Terraform preferred)


• Experience implementing both native Sentinel data connectors as well as custom connectors using Rest API, Logs ingestion API, CEF, Syslog, Azure Functions, and Custom Logs


• Experience with Azure DCR (data collection rules), Azure Monitor, Azure Monitoring Agent, Azure Policy, Azure Log Analytics, Azure Alerts, Kusto Query Language, User & Entity Behavior Analytics (UEBA), Analytic Rules, and Monitoring Workbooks to support a Microsoft Sentinel implementation


• Experience utilizing Azure Arc for managing resources in a hybrid Azure Commercial, Azure Gov, AWS, GCP and OnPrem environment


• Experience being involved in workstreams where you are an active contributor and can talk to the progress and results of assigned tasks


• Ability to support other Azure Cloud engineering tasks as needed


• Ability to be on call as needed

Bonus points if you have:

• Azure Administrator and/or Architecture Certification


• Azure Security Engineer Associate Certification


• Experience migrating Splunk to Sentinel


• Experience with security compliance and NIST 800-171


• Enjoy learning new technologies quickly and staying up to date on cloud technology