Security Operations Analyst (SIEM Operations and Threat Detection)

免费注册后解锁"你的匹配分 vs 高分画像"与个人技能缺口。

Talan – Positive Innovation
Talan is an international consulting group specializing in innovation and business transformation through technology. With over 7,200 consultants in 21 countries and a turnover of €850M, we are committed to delivering impactful, future-ready solutions.
Talan at a Glance
Headquartered in Paris and operating globally, Talan combines technology, innovation, and empowerment to deliver measurable results for our clients. Over the past 22 years, we’ve built a strong presence in the IT and consulting landscape, and we’re on track to reach €1 billion in revenue this year.
Our Core Areas of Expertise
Data & Technologies:  We design and implement large-scale, end-to-end architecture and data solutions, including data integration, data science, visualization, Big Data, AI, and Generative AI.
Cloud & Application Services:  We integrate leading platforms such as SAP, Salesforce, Oracle, Microsoft, AWS, and IBM Maximo, helping clients transition to the cloud and improve operational efficiency.
Management & Innovation Consulting:  We lead business and digital transformation initiatives through project and change management best practices (PM, PMO, Agile, Scrum, Product Ownership), and support domains such as Supply Chain, Cybersecurity, and ESG/Low-Carbon strategies.
We work with major global clients across diverse sectors, including Transport & Logistics, Financial Services, Energy & Utilities, Retail, and Media & Telecommunications.

We are looking to join a Senior consultant within the Cyber Security Operations Center (CSOC) , a globally distributed team of cybersecurity professionals responsible for protecting complex and diverse technology environments. 
The role is primarily focused on enhancing threat detection and cybersecurity operations capabilities through activities such as security content management, quality assurance and validation of detection mechanisms, detection use case lifecycle management, onboarding and integration of new security data sources, reporting, and process optimization.
This is an excellent opportunity for professionals interested in working within a large-scale international cybersecurity environment, where they will play a key role in the continuous improvement of security monitoring and threat detection services across multiple customer landscapes. The position combines elements of Security Operations, Threat Detection Engineering, SIEM optimization, cyber risk management, and operational excellence , offering exposure to a wide variety of cybersecurity technologies and challenges.
Main Responsibilities:
Contribute to the development, implementation, validation, tuning, and maintenance of security monitoring, analytics, and detection capabilities across SIEM, EDR, cloud, and other cybersecurity platforms.
Support the operation, maintenance, optimization, and continuous improvement of security monitoring and threat detection services.
Participate in the onboarding, integration, testing, and validation of security data sources, telemetry feeds, and monitoring capabilities.
Contribute to security content management activities, including use case lifecycle management, rule reviews, testing, tuning, and content quality assurance.
Collaborate with cyber threat intelligence, incident response, and cybersecurity operations teams to translate operational and threat intelligence requirements into effective detection and monitoring capabilities.
Under guidance, participate in cybersecurity architecture reviews of new or existing solutions and provide recommendations to enhance security monitoring and detection effectiveness.
Contribute to the preparation and maintenance of cybersecurity operations metrics, dashboards, KPIs, and service performance reports.
Review, validate, and assess the effectiveness of detections, monitoring configurations, operational processes, and service deliverables, identifying opportunities for improvement.
Gather and analyze operational feedback to identify opportunities for tuning, optimization, reduction of false positives, and improvement of overall detection quality.
Contribute to quality assurance activities, including process reviews, control validation, service quality assessments, and implementation of corrective actions.
Support the development, review, and maintenance of CSOC procedures, standards, documentation, knowledge base articles, and operational guidance materials.
Prepare and present technical reports, summaries, findings, and recommendations to internal and external stakeholders.

On-Call Availability (On-Call Shift System)
Mandatory 24/7 On-Call Rotation: You will be required to participate in a rotating on-call shift schedule from Monday to Sunday.

What this means: This does not mean you will be actively working 24/7 or during late-night shifts. Instead, you will be on standby outside of standard working hours, meaning you must be reachable and available to log in and resolve critical system incidents only if they arise.

Frequency: The approximate rotation frequency is one full week (7 consecutive days) every X months , depending on the number of team members

Must have:
+5 years of relevant experience in information technology field, including triage of alerts and supporting security incidents
Proven experience on administering a SIEM platform , preferably either Splunk or Microsoft Sentinel SIEM 
Proven experience with the usual toolbox available in a SOC (e.g., SIEMs, EDRs) and being able to autonomously perform technical analysis of security threats and collaborate with Incident Response team
Deep knowledge of Microsoft Security Tools (e.g. M365, Cloud App Security, Azure,Defender for Endpoints, Azure Security, Azure Sentinel and XDR)
Deep Knowledge of Cloud technologies (e.g. Azure, AWS and GCP )
Deep knowledge of SIEM tools like Splunk, QRadar, ArcSight, MS Sentinel, ELK Stac
Knowledge of at least one EDR solution (MS Defender for Endpoint, CrowdStrike)
Knowledge of email security, network monitoring, and incident response
Knowledge of Linux/Mac/Windows
C1 English proficiency
Nice to have:
Experience in building SIEM architectures from initial design to implementation, including designing data ingestion pipelines for diverse log sources across cloud and on-prem environments
Proven knowledge of monitoring AWS environment (Iaas, Saas, Paas)
Knowledge of at least one general-purpose or shell scripting language (e.g. Ruby, Bash, PowerShell, Python, etc.)
Desirable certifications:
MCSE, CCNA, Microsoft Azure (e.g., SC-200), GCIH, CEH, GCFA or any GIAC/similar certification
Required Soft Skills:
Excellent communication skills
Customer-facing experience and oral communication skills
Ability to write documentation & reports
Creativity/ ability to find innovative solutions
Willingness to learn on the job
Conflict management & cooperation

What do we offer you?
Remote Position
Freelance, full-time contract.
Training and career development.
Possibility to be part of a multicultural team and work on international projects.

If you are passionate about data, development & tech, we want to meet you!
Talan Spain’s commitment to non-discrimination based on gender, race, ideology, or any other reason, in accordance with the company’s "Equality Plan" and the current regulations on gender equality between women and men (Royal Decree-Law 6/2019).

Talan – 正向创新
Talan是一家国际咨询集团，专注于通过技术实现创新和业务转型。我们在21个国家拥有超过7，200名顾问，营业额达8.5亿欧元，致力于交付具有影响力的、面向未来的解决方案。
Talan概览
Talan总部位于巴黎，业务遍布全球，将技术、创新和赋能相结合，为客户交付可衡量的成果。在过去22年中，我们在IT和咨询领域建立了强大的影响力，并有望在今年实现10亿欧元的营收。
我们的核心专业领域
数据与技术：我们设计和实施大规模端到端架构和数据解决方案，包括数据集成、数据科学、可视化、大数据、AI和生成式AI。
云与应用服务：我们整合SAP、Salesforce、Oracle、Microsoft、AWS和IBM Maximo等领先平台，帮助客户迁移至云端并提升运营效率。
管理与创新咨询：我们通过项目和变革管理最佳实践（PM、PMO、Agile、Scrum、Product Ownership）引领业务和数字化转型计划，并支持供应链、网络安全和ESG/低碳战略等领域。
我们与运输与物流、金融服务、能源与公用事业、零售以及媒体与电信等多个行业的全球大型客户合作。

我们正在寻找一位高级顾问加入网络安全运营中心（CSOC），这是一个由网络安全专业人员组成的全球分布式团队，负责保护复杂多样的技术环境。
该职位主要专注于通过以下活动增强威胁检测和网络安全运营能力：安全内容管理、检测机制的质量保证与验证、检测用例生命周期管理、新安全数据源的接入与集成、报告以及流程优化。
对于有兴趣在大型国际网络安全环境中工作的专业人士来说，这是一个绝佳的机会，他们将在持续改进多个客户环境中的安全监控和威胁检测服务方面发挥关键作用。该职位融合了安全运营、威胁检测工程、SIEM优化、网络风险管理和运营卓越等要素，提供接触各种网络安全技术和挑战的机会。
主要职责：
为SIEM、EDR、云和其他网络安全平台的安全监控、分析和检测能力的开发、实施、验证、调优和维护做出贡献。
支持安全监控和威胁检测服务的运营、维护、优化和持续改进。
参与安全数据源、遥测数据流和监控能力的接入、集成、测试和验证。
为安全内容管理活动做出贡献，包括用例生命周期管理、规则审查、测试、调优和内容质量保证。
与网络威胁情报、事件响应和网络安全运营团队合作，将运营和威胁情报需求转化为有效的检测和监控能力。
在指导下，参与新解决方案或现有解决方案的网络安全架构审查，并提供建议以增强安全监控和检测的有效性。
为网络安全运营指标、仪表板、KPI和服务绩效报告的编制和维护做出贡献。
审查、验证和评估检测、监控配置、运营流程和服务交付成果的有效性，识别改进机会。
收集和分析运营反馈，以识别调优、优化、减少误报和提高整体检测质量的机会。
为质量保证活动做出贡献，包括流程审查、控制验证、服务质量评估和纠正措施的实施。
支持CSOC程序、标准、文档、知识库文章和运营指导材料的开发、审查和维护。
准备并向内部和外部利益相关者提交技术报告、摘要、发现和建议。

待命可用性（待命轮班制度）
强制性的24/7待命轮换：您将被要求参与周一至周日的轮换待命班次安排。

这意味着什么：这并不意味着您将24/7或在深夜班次中实际工作。相反，您将在标准工作时间之外处于待命状态，这意味着您必须保持可联系和可登录状态，仅在出现关键系统事件时进行解决。

频率：大致的轮换频率为每X个月一整周（连续7天），具体取决于团队成员数量。

必须具备：
5年以上信息技术领域相关经验，包括告警分类和支持安全事件
具有管理SIEM平台的丰富经验，最好是Splunk或Microsoft Sentinel SIEM
具有SOC中常用工具（例如SIEM、EDR）的丰富经验，能够自主执行安全威胁的技术分析并与事件响应团队协作
深入了解Microsoft安全工具（例如M365、Cloud App Security、Azure、Defender for Endpoints、Azure Security、Azure Sentinel和XDR）
深入了解云技术（例如Azure、AWS和GCP）
深入了解SIEM工具，如Splunk、QRadar、ArcSight、MS Sentinel、ELK Stack
了解至少一种EDR解决方案（MS Defender for Endpoint、CrowdStrike）
了解电子邮件安全、网络监控和事件响应
了解Linux/Mac/Windows
C1英语水平
加分项：
具有从初始设计到实施构建SIEM架构的经验，包括为云和本地环境中的多种日志源设计数据摄取管道
具有监控AWS环境（IaaS、SaaS、PaaS）的丰富知识
了解至少一种通用或Shell脚本语言（例如Ruby、Bash、PowerShell、Python等）
理想认证：
MCSE、CCNA、Microsoft Azure（例如SC-200）、GCIH、CEH、GCFA或任何GIAC/类似认证
所需软技能：
出色的沟通能力
面向客户的经验和口头沟通能力
能够撰写文档和报告
创造力/找到创新解决方案的能力
愿意在工作中学习
冲突管理与合作

我们为您提供什么？
远程职位
自由职业者，全职合同。
培训和职业发展。
有机会成为多元文化团队的一员并参与国际项目。

如果您对数据、开发和技术充满热情，我们期待与您见面！
Talan Spain致力于不因性别、种族、意识形态或任何其他原因进行歧视，符合公司的“平等计划”和现行关于男女平等的法规（皇家法令-法律6/2019）。

⚑ 岗位信息收录自公开招聘页（ATS 官方），以雇主官网为准