Security Operations Center Engineer

Mercury Insurance is seeking a Security Operations Center Engineer to support its technology and information security operations. The role monitors, investigates, and responds to security alerts and incidents, administers SOC/NOC tools, documents security processes, minimizes infrastructure risk, and participates in disaster recovery and business continuity events.

Responsibilities:

• Monitor security tools & systems: Analyze logs, alerts, and data for suspicious activity
• Investigate potential threats: Determine if alerts are real incidents and identify vulnerabilities
• Supervise all Incident/Security issues, including preliminary triage, troubleshooting and remediation
• Gather evidence: Collect and analyze evidence to understand incident scope and impact
• Contain the threat and remediate vulnerabilities: Quickly contain the incident to minimize damage, and implement patching, configuration changes, or other measures to address the exploited vulnerabilities
• Recover from the incident and report to management: Assist in restoring affected systems and data to their normal state, and keep management informed about security incidents and response efforts
• Documentation: Document findings for future reference and improvement, including process roadmaps, change management validations, and user/system impacted incident management and resolutions
• Administer SOC/NOC tools: Manage and administer all SOC/NOC Operations center owned tools, including scripting, customizations, report building, alert modifications, automations, and maintenance
• Minimize risk and exposure to system security and business interruptions of the company's infrastructure
• Participate in disaster recovery and BCP events: Actively participate in disaster recovery and Business Continuity Plan (BCP) events.e

Requirements:

• BS degree in Computer Science, Information Technology, related field; and/or equivalent combination of education or work experience
• 2-4 years of 24x7x365 Security Operations experience and related technologies
• Enterprise Security Operations support experience
• Enterprise security document creation
• Understanding of IT infrastructure and networking: This includes knowledge of operating systems, network protocols, and basic infrastructure components
• Security principles and technologies: Familiarity with common security threats, vulnerabilities, and mitigation strategies like firewalls, intrusion detection/prevention systems (IDS/IPS), and SIEM tools
• Scripting and automation: Ability to write basic scripts to automate tasks and generate reports
• Incident response procedures: Understanding of established processes for handling security incidents, including containment, eradication, and recovery
• Security tools and software: Proficiency in using the specific security tools and software typically employed by a security organization
• Experience in using ExtraHop, Qradar, Splunk and/or any other security related tools for the visibility, monitoring, detection, alerting, response, and investigation of security related events
• Communication: Clear and concise communication with technical and non-technical audiences, including reporting incidents to management and collaborating with other IT teams (including public speaking, critical business writing skills, process documentation and knowledge base article composure)
• Critical thinking and problem-solving: Ability to analyze complex security data, identify root causes of incidents, and develop effective solutions
• Attention to detail: Meticulous focus on identifying subtle anomalies and potential threats within vast amounts of data
• Decision-making under pressure: Making quick and informed decisions during critical security incidents
• GIAC Security Essentials Certification
• GIAC Security Leadership Certification
• ISACA Certified Information Security Manager
• Microsoft Certified Systems Engineer: Security
• (ISC)2 SCCP
• (ISC)2 CISSP
• (ISC)2 ISSAP
• CCSK4
• 5 or more years of 24x7x365 Security Operations and related technologies
• ServiceNow
• SIEM Solutions
• TrustWave
• Email Protection Solutions
• Endpoint Detection & Response Solutions
• Microsoft 365 Security Suite
• Incident Management Communication tools
• CV/CIRT Gov't notification process
• Load balancers & Web Application Firewall Solutions
• Firewall/router/networking equipment
• Web Content Filtering (WSS)
• Secure Web Gateway Solutions
• ITIL Foundations certifications (V3 or V4)