• Utilize MITRE ATT&CK and Threat Intel from multiple sources to drive EDR and SIEM rule development and identify logging gaps• Act as a subject matter expert for the EDR tool• Develop and enhanced capabilities in EDR Tool to aid in DFIR and Vulnerability Management• Develop and tune real time EDR rules for use by the SOC• Lead initiatives for new detection and response capabilities within the SOC• Author, update, and maintain SOC Runbooks and team procedures• Work with multiple groups throughout the Incident Response Lifecycle: Preparation (rule development), Detection (SIEM/EDR), Analysis, Containment, Eradication, Recovery, and Post Incident (lessons learned and further rule development)• Conduct static and dynamic analysis of suspicious files• Act as a technical point of escalation to Analysts on shift• Conduct user activity investigations as requested by HR

• Triage incoming alerts for multiple clients using custom SIEM, HIDS, and NIDS.• Perform first step Incident Response including notification, containment, and initial findings.• Perform Active Response for clients including firewall blocks, Active Directory password resets, and host isolation.• Conduct basic malware analysis using OSINT tools and virtual lab environment. • Research logging methods of new sources to create high confidence alerting and generate SOP around new rules and alerts.• Perform alert suppression to reduce overall noise and increase SOC efficiency.• Perform QA on Analysts alerts and tickets to ensure proper quality responses.• Conduct routine Nessus scans against client environments and on demand scans as required• Answer client emails and phone calls providing security advice, further analysis on events, and general troubleshooting.• Act as a technical point of escalation to Analysts on shift and during off hours.• Alert clients on new potential vulnerabilities and phishing campaigns

• Implemented company policies, technical procedures and standards.• Recommended network security standards to management.• Monitored network performance and provided network performance statistical reports for both real- time and historical measurements.• Implemented and maintained firewalls, series switches and security appliances.• Managed firewall, network monitoring and server monitoring both on- and off-site.• Troubleshot and maintained all networking devices and infrastructure across the enterprise including switches, routers and firewalls.• Documented server and network incidents in detail.• Perform monthly and quarterly security audits of all systems and network devices.• Upgraded and expanded network systems and their components.• Kept up-to-date on new developments in computer and network vulnerabilities, data breach trends and encryption.• Troubleshoot and manage company's camera system including cameras, NVRs, and DVRs.• Implemented company policies, technical procedures and standards.• Recommended network security standards to management.• Monitored network performance and provided network performance statistical reports for both real- time and historical measurements.• Implemented and maintained firewalls, series switches and security appliances.• Managed firewall, network monitoring and server monitoring both on- and off-site.• Troubleshot and maintained all networking devices and infrastructure across the enterprise including switches, routers and firewalls.• Documented server and network incidents in detail.• Perform monthly and quarterly security audits of all systems and network devices.• Upgraded and expanded network systems and their components.• Kept up-to-date on new developments in computer and network vulnerabilities, data breach trends and encryption.• Troubleshoot and manage company's camera system including cameras, NVRs, and DVRs.