Sr Operation Mgmt Specialist

Key Responsibilities

• Real-Time Surveillance: Maintain high vigilance monitoring of the Microsoft Sentinel Incident queue to identify anomalies and potential security breaches.
• Noise Reduction: Distinguish between benign environmental behaviour and malicious activity to reduce alert fatigue within the SOC.
• Severity Assessment: Categorize and prioritize incidents based on business impact, asset criticality, and the MITRE ATT&CK framework.
• KQL Proficiency: Utilize Kusto Query Language (KQL) to perform deep-dive log analysis across Security Event, Sign in Logs, and Office Activity tables.
• Root Cause Analysis: Conduct forensic to reconstruct timelines to validate the legitimacy of alerts.
• Evidence Gathering: Correlate data across the Microsoft 365 Defender stack (Endpoint, Identity, Cloud Apps) to build a comprehensive picture of the threat actor's movements.
• Automated Response: Execute Azure Logic App Playbooks to perform rapid containment actions, such as revoking AAD sessions or isolating compromised hosts.
• Standard Operating Procedures (SOPs): Establish SOP to ensure a consistent and compliant response to known threat vectors.
• Manual Remediation: Perform manual intervention when automated flows are inapplicable, ensuring the 'Time to Remediate' (TTR) is minimized.
• Audit Trail Management: Maintain meticulous, chronological records of all investigative steps and findings within the ITSM ticketing system (e.g., ServiceNow).
• Technical Summaries: Draft clear, concise post-incident summaries detailing the scope of the impact and the steps taken for resolution.
• Knowledge Base Contribution: Update internal wikis or 'Runbooks' with new findings to improve the team's collective response capability.