Brief Description
Security Content Analyst is responsible for building filtering rules, detecting cyber attacks, and identifying new information security risks for VCS security solutions (such as EDR, NSM, SIEM, KIAN…) according to solution standards as well as international standards (such as snort/suricata, yara…)
· Build attack detection rules for VCS solutions according to the standards and format of each solution
· Build attack detection rules according to common international standards and formats such as snort/suricata, yara, sigma…
· Modify and optimize attack detection rules based on feedback from solution operations teams, information security monitoring teams, or other related departments
· Research and understand VCS information security solutions, propose additional data sources for solutions to detect attacks
· Research, participate in workshops, propose and agree on attack methods, defense strategies for attack techniques and new risks
Qualifications
Training Specialization
Certifications
Scope of Work Responsibilities
Requirements
· At least 1 year of experience in information security
· Basic knowledge of information security & cyber attack methods (with CEH, Security+ certification) or equivalent assessment
· Understand and be familiar with common Data Sources, clearly understand the relationships between different types of Data Sources
· Knowledge of the operating mechanisms of major defense solutions at host layer, network layer, log layer…, solutions such as EDR/NSM/SIEM/KIAN
· Skills in building various types of rules at network layer, endpoint layer (such as snort/suricata, yara…)
· Priority given to candidates with certifications: CEH and OSCP