SOC Analyst

Ciena is committed to our people-first philosophy. Our teams enjoy a culture focused on prioritizing a personalized and flexible work environment that empowers an individual’s passions, growth, wellbeing and belonging. We’re a technology company that leads with our humanity—driving our business priorities alongside meaningful social, community, and societal impact.

Not ready to apply? Join our Talent Community to get relevant job alerts straight to your inbox.

The Security Organization 

The Security team at Ciena is a tightly knit group of skilled professionals who share the same passion for defending against cyber criminals. With the increase in volume and sophistication of cyber-crime, we are growing and have tons of exciting work planned. This may require working extra hours on an as needed basis.

What will you do at Ciena?

The SOC Analyst role will support the Ciena security program through active monitoring, analysis and classification of security events in the enterprise environment.

The analyst will be expected to investigate and respond to information security incidents, develop, maintain, and follow procedures for security event alerting, and participate in security investigations. The analysts must be capable of independently performing security investigations covering all facets of an enterprise environment (e.g. network, endpoint, identity, cloud, data access, etc.)

The analyst should have familiarity with the incident response lifecycle, principles of network and endpoint security, current threat and attack trends, OSI model, and have a working knowledge of defense in depth strategies.

The analyst will be responsible for various activities within the security incident response lifecycle including detection, analysis, containment, eradication, recovery, and incident post-mortem reviews. The analyst will be expected to thoroughly document their investigations and response actions.

The analyst will assist with development of new security alerts and tuning existing alerts for improving detection accuracy. The analyst will also be responsible for performing proactive threat hunting, vulnerability and threat intelligence research as well as reviewing threat intelligence reports from our security partners.
 

Operations:

• Monitor SIEM, EDR, and other security tools for detection and identification of security events
• Document security investigations in a clear and consistent manner
• Develop new use cases for security alerts
• Tune existing use cases to improve accuracy
• Tune endpoint and network security tools as needed
• Perform threat hunting to identify potential security threats
• Perform vulnerability and threat intelligence research
• Review threat intelligence reports
• Ability to work after hours if needed

Security Event Response:

• Perform security anomaly and event detection
• Investigate, contain, and resolve security anomalies and events
• Perform threat attribution
• Identification of likely threat vector for security events and incidents

Minimum Qualifications:

• Ability to read, write, speak and understand the English language to communicate with employees, customers, suppliers, in person, on the phone, and by written communications in a clear, straightforward, and professional manner
• Experience working with multiple SIEM, EDR, Log Aggregators, and Incident Response Management solutions
• Strong technical knowledge of Networking, Operating Systems and enterprise integrations
• Firm understanding of the security incident lifecycle
• Thorough understanding of TCP/IP
• Understand IDS / IPS rules to identify and/or prevent malicious activity
• Basic knowledge of forensic methodologies and best practices to investigate intrusions, preserve evidence and coordinate a unified security response
• Ability to proactively perform threat hunting to identify undetected security events
• Basic knowledge of malware analysis
• Basic understanding of SQL
• Understanding of Packet Analysis (PCAP) and Packet Analysist software

Preferred Qualifications:

• Bachelor’s degree in Cybersecurity, Computer Engineering, Information Technology or related field.
• Candidate will possess ability to be a successful self-starter
• Experience with Python, PowerShell, and API programming is a plus
• Understanding of the MITRE ATT&CK and Cyber Kill Chain frameworks

#LI-SM