ICT Security SOC Analyst

The Role

Specifically, the successful jobholder will be required to

• Monitor the Bank's networks and systems on a 24-hour basis using Security Information and Event Management (SIEM) tools to detect, analyse and investigate potential security threats.
• Conduct proactive threat research, monitor open-source intelligence sources and identify emerging cyber threats that could affect the Bank. Recommend, implement and support appropriate defensive measures.
• Triage security alerts, investigate suspicious activities, analyse security logs and support the containment, eradication and resolution of cyber incidents in collaboration with relevant ICT teams.
• Analyse network and host-based security logs, including firewall, intrusion detection and system logs, to determine the appropriate corrective actions, mitigation measures and escalation pathways.
• Maintain accurate records of security investigations, document incident response activities, track resolution actions and provide timely status updates and periodic reports to management.
• Support the development and maintenance of Security Operations Centre (SOC) procedures, monitoring use cases, incident response processes and security documentation to enhance detection and response capabilities.
• Work closely with ICT Security, ICT Risk and Control, Security Services and other technical teams to investigate incidents, address vulnerabilities and ensure timely resolution of security risks.
• Keep abreast of emerging cybersecurity threats, technologies and industry best practices through relevant training, research and professional development.

Skills, Competencies and Experience

The successful candidate will be required to have the following skills and competencies:

• A bachelor's degree in Information Technology, Computer Science or a related field.
• At least one year of experience as a Security Administrator, Network Administrator or in a related technical role, or equivalent knowledge.
• Professional certification in CEH or CySA+ is mandatory. Additional certifications such as CISSP, CISA, CCNA or other recognised cybersecurity certifications are desirable and will be considered an added advantage.
• Technical knowledge of SIEM & SOAR solutions, network, database and operating system security.
• A good understanding of security methodologies, processes and technologies, including firewalls and intrusion detection systems.
• Knowledge of TCP/IP protocols, network analysis, common internet protocols and network security applications.
• Experience in information security, security engineering or analytical roles within complex business environments.
• Knowledge of SQL will be an added advantage.