Vision Cybersecurity

Security Analyst

• Handle configuration requests, incidents, planned tasks, and issues related to network security
• Gather information from clients and internal teams, such as the NOC and SOC
• Develop analytical reports or RCAs and prepare technical assessments
• Review reports prepared by other analysts, ensuring clear and formal communication
• Ensure SLA compliance through the handling, logging, and resolution of requests
• Support teams in implementing new features and propose improvements to processes and practices
• Conduct routine security and asset health checks
• Create and maintain an up-to-date knowledge base and document completed activities
• Analyze and process security incidents, determining the best approach for resolution
• Contribute to improvements in security and technical support processes with Security and Infrastructure teams
• Monitor and support the procurement team with equipment licensing

Network Cybersecurity Analyst

Analyst

• Process, analyze, and manage cybersecurity requests, incidents, problems, and tasks
• Perform advanced analysis of events and alerts from SIEM, EDR, firewalls, IDS/IPS, proxy, Active Directory, and other telemetry sources
• Correlate events to identify malicious behavior
• Investigate incidents, including IOCs, TTPs, lateral movement, privilege escalation, persistence, and potential data exfiltration
• Participate in crisis rooms (war rooms) for high-severity incidents
• Contribute to the containment, eradication, mitigation, and recovery of compromised environments
• Analyze firewall logs, blocks, suspicious sessions, C2 communications, exploitation attempts, lateral movement, and exfiltration
• Support DFIR operations by preserving and collecting evidence
• Prepare technical and executive incident reports
• Maintain technical and formal communication with clients and internal teams during incidents
• Conduct proactive threat hunting
• Develop, review, and update playbooks, runbooks, procedures, knowledge bases, and response workflows
• Support the evolution of detection use cases, correlation rules, and response automations
• Contribute to KPIs such as MTTD, MTTA, MTTR, false-positive rate, and operational efficiency
• Perform advanced incident triage, classification, prioritization, and escalation
• Execute immediate containment, including host isolation, IOC blocking, and revocation of compromised credentials
• Conduct EDR, firewall, and SIEM investigations without direct supervision in medium- and high-complexity scenarios
• Request emergency blocks in security controls
• Propose improvements to detection rules, playbooks, processes, and cyber defense policies
• Provide technical support to the Tier 1 team for complex escalations
• Validate indicators of compromise and recommend engaging specialized teams
• Participate in technical decision-making during critical incidents

Tier 2 Cyber Defense Analyst – Incident Analysis

• Develop and optimize SOAR workflows to automate security incident detection, investigation, and response tasks
• Reduce detection and response times
• Integrate SOAR with security tools such as SIEM, EDR, and forensic analysis tools
• Create a unified and efficient security platform
• Assess and manage security risks
• Implement appropriate security controls to protect the organization’s assets
• Identify opportunities to improve security processes and automate additional tasks
• Develop and maintain technical documentation for automated processes and workflows

SOAR Analyst

• Process, analyze, and manage requests, incidents, problems, and tasks related to cybersecurity
• Perform advanced analysis of events and alerts from SIEM, EDR, firewalls, IDS/IPS, proxy, Active Directory, and other telemetry sources
• Correlate events to identify malicious behavior
• Investigate security incidents, including IOCs, TTPs, lateral movement, privilege escalation, persistence, and potential data exfiltration
• Participate in war rooms during high-severity incidents
• Contribute to the containment, eradication, mitigation, and recovery of compromised environments
• Perform specialized analyses of firewall devices
• Support DFIR operations by preserving and collecting evidence
• Prepare technical and executive incident reports
• Maintain formal technical communication with clients and internal teams during incidents
• Conduct proactive threat hunting based on hypotheses, IOCs, and suspicious behavior
• Develop, review, and update playbooks, runbooks, procedures, knowledge bases, and incident response workflows
• Support the enhancement of detection use cases, correlation rules, and response automations
• Contribute to KPIs such as MTTD, MTTA, MTTR, false-positive rate, and operational efficiency
• Triage, classify, prioritize, and escalate incidents
• Perform immediate containment, including host isolation, IOC blocking, and revocation of compromised credentials
• Conduct technical investigations in EDR, firewall, and SIEM environments without direct supervision in medium- and high-complexity scenarios
• Provide technical support to the Tier 1 team and participate in technical decision-making during critical incidents

Network Cybersecurity Analyst

Tier 2 Cyber Defense Analyst – Incident Analysis

SOAR Analyst

Cyber Defense Analyst, Tier 2 – Incident Analysis