• Maintain accurate investigation records and document outcomes

• Document investigation steps, outcomes, and lessons learned

• Provide contextual guidance to analysts during escalations and oversee the full lifecycle of incident management.

Platform Configuration and Optimization:

• Develop, modify, and maintain detection use cases, correlation rules, and response playbooks tailored to client environments.

• Recommend improvements to SOC/MXDR processes, procedures, and policies

• Provide input on tuning detection rules, alert logic, and reducing false positives

• Identify ineffective alerts and suggest enhancements

• Contribute to configuration, tuning, and continuous optimization of SIEM, EDR/XDR, and related platforms to maximize threat visibility and detection precision.

• Research, develop, and communicate solutions to detected security incidents promptly

• Design and implement high-fidelity detection rules, dashboards, and automation playbooks aligned to the MITRE ATT&CK framework and client-specific risks.

Proactive Threat Hunting and Documentation:

• Perform proactive threat hunting and research to detect evasive or hidden attacker behaviours.

• Maintain thorough incident records, SOP’s, and contribute to internal documentation and client materials.

• Prepare high-quality technical and executive-ready reports that translate security risks into actionable advice.

Security Assessments and Recommendations:

• Perform comprehensive assessments of client environments to identify security control gaps, misconfigurations, and exposure to evolving threats.

• Benchmark client environments against recognized industry frameworks such as

• MITRE ATT&CK, NIST, and CIS to drive measurable security improvements.

• Deliver tailored security recommendations and lead posture review sessions and

• workshops with stakeholders.

Client Interaction and Team Collaboration:

• Respond to service requests and lead client meetings, incident briefings, and reviews.

• Coordinate escalations across multiple teams, ensuring smooth collaboration and knowledge transfer.

• Conduct quality reviews of incident handling and contribute to continual improvement efforts.

• Support client onboarding activities, including but not limited to baseline reviews and deployment of automated playbooks and response workflows.

• Mentor Cyber MXDR analysts, promoting best practices within the team.

Qualifications, Skills & Competencies

• A bachelor’s degree / diploma in a relevant area with a preference for Information Security, Computer Science or Computer Engineering.

Amazon Web Services:

• CLF-C02 AWS Certified Cloud Practitioner

CompTIA:

• Network+

• Security+

• CYSA+ - Cybersecurity Analyst

Microsoft:

• AZ-900 – Microsoft Certified: Azure Fundamentals

• MS-900 – Microsoft 365 Certified: Fundamentals

• SC-900 - Microsoft Security, Compliance, and Identity Fundamentals

• SC-200 - Microsoft Security Operations Analyst

• MD-102 – Microsoft 365 Certified: Endpoint Administrator Associate

• AZ-500 – Microsoft Certified Azure Security Engineer Associate

Linux Professional Institute (LPI):

• 010-160 – Linux Essentials

• 020-100 – Security Essentials

Python Institute:

• PCEP– Certified Entry-Level Python Programmer

Qualys:

• Vulnerability Management

• Global IT Asset Inventory and Management

• Advanced Scanning

Preferred Experience

• Infrastructure and System Administration:

• 3-5 years of experience in infrastructure support and system administration, including deployment, troubleshooting, and performance tuning in hybrid environments (on-premises and cloud).

• Expert knowledge of operating systems, particularly Windows Server and Workstation, as well as Linux/Unix variants.

• Extensive experience with endpoint deployment and configuration management tools Microsoft Intune is required. Microsoft SCCM is beneficial.

• Proficiency in Amazon Web Services (AWS) beneficial.

• Security Operations and Incident Management:

• Advanced experience with SIEM platforms (Microsoft Sentinel required)

• Advanced experience with Microsoft Defender XDR Solutions

• 3-5 years of previous Security Operations Centre experience as a MXDR Analyst

• Advanced expertise in security incident management, malware handling, vulnerability management, and use of MITRE ATT&CK-aligned detection methodologies.

• Advanced experience with antivirus solutions, virus outbreak management, and attack pattern differentiation

• Solid understanding of vulnerability scoring systems (CVSS/CMSS) and tracking mitigation effectiveness.

Cloud and Microsoft Azure:

• Experience with Microsoft Azure, especially its security and monitoring capabilities, such as Azure Security Center, Microsoft Sentinel, and Azure AD.

Networking:

• Advanced knowledge of networking principles including TCP/IP, WANs, LANs, and commonly used Internet protocols such as SMTP, HTTP, FTP, POP, LDAP.

• Solid understanding of firewalls/security stack devices

• Experience with web content filtering technology - policy engineering and troubleshooting.

• Scripting, Automation & Tooling

• Proficient in Python and Bash scripting

• Advanced level KQL scripting

Communication and Collaboration:

• Excellent written and verbal communication skills in English

• Able to present findings clearly and contribute to reporting and documentation

• Works effectively with team members, senior consultants, and clients