Thrive

Security Operations

• Oversee the daily operations of Thrive’s Security Operations Center, leading and mentoring Tier 1 and Tier 2 SOC Analysts.
• Manage security event monitoring, incident response, and resource management.
• Develop and implement processes and procedures for incident response, threat detection and analysis, security event management, and reporting.
• Develop incident response and incident management playbooks, including threat triage, incident investigation, and incident resolution.
• Ensure compliance with Service Level Agreements, process adherence, and process improvement.
• Perform threat management and threat modeling, identify threat vectors, and develop security monitoring use cases.
• Proactively monitor and respond to known and emerging threats.
• Create reports, dashboards, and metrics for clients and senior management.
• Motivate and coach individual contributors to achieve departmental goals and consistent customer service.
• Drive continuous improvement of SOC incident handling and security investigations.
• Define metrics and KPIs to drive quality and efficiency.
• Conduct annual performance reviews for direct reports.
• Uphold procedural requirements for prioritization, communication, documentation, and escalations.
• Follow up with customers to identify improvement areas and provide feedback to internal teams and management.
• Serve as the escalation point for SOC customer service and technical issues.
• Adjust priorities and balance responsibilities in a fast-paced environment.
• Perform other duties as required.

Director, Security Operations Center

Systems Engineer

• Provide first-contact remote technical support for network, server, and end-user systems.
• Communicate with customers via phone, email, and chat, providing clear updates and case status.
• Perform first response and initial triage of customer issues.
• Troubleshoot single-user and system-impacting incidents and document all actions in Thrive’s tools.
• Analyze workstation-level incidents, identify root causes, and apply appropriate troubleshooting methods.
• Ask clarifying questions and escalate issues to engineers when required.
• Manage daily prioritization, coding, and routing of service incidents and requests.
• Follow Thrive’s established task-management best practices.
• Set and manage client expectations throughout troubleshooting.
• Develop understanding of Thrive products and their integration into client environments.
• Work with and document diverse workstation, server, and network configurations to determine the fastest path to resolution.

Incident Response Analyst

• Process investigation requests from SOC Analysts monitoring security events through SIEM across network and host-based IDS/IPS, network infrastructure logs, system logs, applications, and databases
• Investigate intrusion attempts, distinguish false positives from true intrusions, and perform in-depth exploit analysis
• Lead incident response and threat hunting for confirmed High Priority security incidents through resolution
• Use threat intelligence to identify and investigate potential security threats
• Develop incident response and incident management playbooks covering threat triage, investigation, and resolution
• Review and update playbooks for currency and effectiveness
• Collaborate with cross-functional teams to align playbooks with security strategy and goals
• Participate in tabletop exercises and drills to test and validate playbooks
• Monitor and evaluate incidents to identify playbook improvement opportunities
• Track current security threats and trends to keep playbooks relevant
• Investigate current vulnerabilities, advisories, incidents, and TTPs and collaborate with Security Engineering on recommended use cases
• Proactively monitor, hunt, and respond to known and emerging threats
• Execute Thrive’s information security strategy internally and externally for 400+ clients
• Analyze data from SOC, SIEM, and EDR platforms and determine whether further analysis is needed
• Follow Thrive security standards and best practices and recommend enhancements
• Stay current on security events and techniques to protect clients