Job description
1. Operate and monitor network security systems:
- Use security tools such as Firewall, SIEM (Security Information and Event Management), XDR (Extended Detection and Response), IDS (Intrusion Detection System), IPS (Intrusion Prevention System), EDR (Endpoint Detection and Response), etc. to monitor and analyze security events, ensure timely detection and handling of cybersecurity risks.
- Continuously monitor network systems and IT applications to detect signs of cyberattacks, unauthorized intrusions or abnormal behaviors.
2. Analyze and handle security incidents:
- Investigate security incidents, identify root causes and propose remediation measures.
- Coordinate with relevant departments to implement recovery measures and mitigate risks after incidents occur.
3. Conduct security vulnerability scanning:
- Perform regular security vulnerability scans across the entire network system and IT devices, ensure the system is always updated and protected against the latest vulnerabilities.
- Propose protective measures and remediation of security vulnerabilities, ensure the system complies with security standards.
4. Support implementation of security measures:
- Participate in the implementation of new security measures, including Firewall configuration, XDR/EDR/IDS/IPS/Endpoint systems, application and database security.
- Coordinate with other departments to ensure security measures are applied according to procedures and security standards.
5. Training and raising information security awareness
- Participate in training programs and workshops to raise information security awareness for employees.
- Support company members in understanding and complying with information security policies and procedures.
Requirements
1. Qualifications
- Bachelor's degree in IT, Cybersecurity, Information Systems or related fields.
- Knowledge of international information security standards such as ISO 27001, NIST, GDPR is an advantage.
- Security certifications such as CompTIA Security+, CompTIA CySA+, Blue Team Level 1 (BTL1), CHFI, GCIH is an advantage.
2. Experience
- At least 2-3 years of experience in information security or cybersecurity.
- Understanding of IT system architecture, network security, endpoint, application and other security technologies.
- Proficiency in Threat Intelligence, IOC, TTP, MITRE ATT&CK concepts.
- Knowledge of security methods, risk management, and cyber attack prevention.
- Understanding of security incident handling procedures, digital forensics, behavioral analysis.
- Experience in operating & using SIEM, log analysis, writing monitoring rules.
- Proficiency in programming languages for data analysis such as SQL, Python.
- Experience in researching, developing AI/ML models and deploying automation systems is an advantage.
3. Skills
- Good system monitoring and security incident analysis skills, able to respond quickly to threats.
- Good communication skills, able to work in teams and coordinate with other departments to resolve incidents.
