Security Analyst

Title : Security Analyst
Location : Remote anywhere in Canada
Start: As soon as possible.
Duration : 6+ mois, renewable. 
Description : The objectif is to correct and optimize the RSA NetWitness SIEM platform.
The selected candidate must be able to:

• Take charge of correcting integrations and resolving anomalies;
• Optimize and enhance the current configuration;
• Add new incident detection models;
• Integrate new log sources;
• Improve the quality and relevance of security alerts.

Main responsibilities
1.SIEM administration and management

• Manage log sources: add, integrate, normalize, validate feeds;
• Update parsers, feeds and detection content according to security needs;
• Ensure SIEM availability, performance and security.

2.Continuous improvement and technology watch

• Monitor new threats, vulnerabilities and RSA functionalities;
• Propose and implement continuous improvements in detection, correlation and operational processes;
• Write technical documentation, procedures and integration guides.

3.Event detection and correlation

• Optimize rule tuning to reduce false positives and improve relevance;
• Create and maintain effective correlation rules and alerts to detect anomalous behavior.

4.Security Operations Support (SOC)

• Collaborate with SOC analysts for incident analysis and qualification;

Skills and Experience
The consultant must have :

• Deployed, configured and maintained RSA NetWitness solutions;
• A minimum of 3 years' continuous experience on the platform.

Required Skills

• Excellent command of RSA NetWitness Platform (Logs, Packets, Endpoint, Orchestrator);
• Solid knowledge of networking, Windows/Linux systems and protocols (TCP/IP, DNS, HTTP, etc.);
• Expertise in cybersecurity, threat hunting, forensic and MITRE Telecommunication&CK;
• Demonstrated experience in log source integration (firewalls, EDR, IDS, application servers, etc.);
• Good understanding of SIEM/SOAR architectures and automation processes.