Senior Security Analyst

Key Responsibilities

Security Monitoring & Incident Analysis and Response

• Monitor security events and alerts generated from SIEM, EDR, NDR, IDS/IPS, firewalls, and other security technologies.
• Perform 24x7 security monitoring and threat detection activities.
• Analyze security logs and identify suspicious activities, attack patterns, and potential threats.
• Validate alerts and distinguish true positives from false positives.
• Participate in threat hunting activities and proactive investigations.
• Investigate cybersecurity incidents and conduct root cause analysis.
• Assess the scope, impact, severity, and business risk of security incidents.
• Lead or support incident response activities including containment, eradication, recovery, and post-incident analysis.
• Develop incident reports, investigation findings, and executive summaries.
• Follow established incident response procedures, playbooks, and SOPs.

SIEM and SOAR Platform Administration

• Manage and maintain SIEM and SOAR platforms and associated security monitoring tools.
• Configure and optimize log collection, parsing, normalization, and correlation rules.
• Ensure security logs are properly onboarded and monitored.
• Troubleshoot log ingestion and data quality issues.
• Improve monitoring coverage and visibility across enterprise environments.
• Design, develop, and maintain SIEM use cases and correlation rules.
• Create new detection content based on emerging threats, threat intelligence, and attack techniques.
• Continuously optimize detection rules to improve accuracy and reduce false positives.
• Map detection use cases to the MITRE ATT&CK framework.
• Develop and maintain security monitoring documentation and operational runbooks.

Collaboration & Communication

• Coordinate with IT, infrastructure, application, cloud, and business teams during incident investigations.
• Facilitate communication between stakeholders during security incidents.
• Provide technical guidance and recommendations on security remediation actions.
• Present investigation findings and security recommendations to management.
• Support security awareness programs, tabletop exercises, and incident response drills.

Qualifications

• Bachelor’s degree in computer science, information security, or related technical discipline or equivalent professional experience related to Cybersecurity, Incident Response or information security. Relevant security-related certifications a plus : CISSP, CISP, CEH, Security+ etc.

• 3+ years of Security Operations Center (SOC) work experience with a Bachelor’s degree

• 5+ years of related experience in Cybersecurity or computer network defense role.

• Proven subject matter ability in relevant areas, such as incident response, intrusion analysis, malware analysis, web application security or security engineering.

• Solid understanding of TCP/IP and internetworking technology including packet analysis, routing and network security defenses.

• Strong knowledge of operating systems (Windows & Linux), network services and applications, malware families and network attack vectors.

• Demonstrated experience in an enterprise-level incident response team or security operations center. Direct experience in handling cyber security incidents and associated incident response tools.

• Experience in operating and utilizing Security Information and Event Management and SOAR tools .Relevant tools experience is plus: MS sentinel, CP4S etc.

• Strong working knowledge of common security tools such as SIEM, AV, WAF, IDS, Netflow, Packet Analyzer and Endpoint Detection & Response tools.

• Experience in SIEM and SOAR administration, Log onboarding and integration, Correlation rule development, Use case design and implementation, security Automation.

• Display great problem solving skills, with tenacity and resilience to resolve issues.

• Excellent communication and presentation skills with proven skill in presenting analytical data effectively to varied audiences.

• Strong interpersonal and leadership skills to influence and build credibility as a peer.

• Strong understanding of cloud technologies and related security best practices.

这对我有什么好处?

• 从事有意义的工作,保护系统、运营和客户免受真实威胁
• 通过认证、专业培训和导师指导机会实现职业发展
• 协作文化,你的专业知识直接影响安全策略
• 旨在支持平衡和身心健康的灵活工作选择

将你的网络安全专业知识带到一个重视你影响力的团队——立即申请!

为您量身打造的回报

我们的全方位奖励体现了我们对您的重视。这不仅是薪酬和福利—it是对您的重要投资。该方案旨在支持您的表现、成长、安全感和潜能提升。它帮助您照顾自己和家人、规划未来、提升技能与职业发展、在包容的环境中协作，并为社区作出贡献。在施耐德电气，我们始终关注对您最重要的事情。欢迎访问我们的 职业发展页面 了解更多。

* 不同国家和地区可能适用不同的计划与项目。

  你是否渴望让自己的职业生涯产生深远影响？ 当你考虑加入一个新团队时，企业文化至关重要。在施耐德电气，我们的价值观与行为准则是构建卓越文化、助力业务成功的基石。我们坚信，“IMPACT” 核心价值观—— 包容（Inclusion）、精进（Mastery）、使命（Purpose）、力行（Action）、求知（Curiosity）、共赢（Teamwork）—— 源于每一位成员的践行。 “IMPACT” 更是我们向你的诚挚邀约：无论你身处何种岗位，都能在施耐德电气将可持续发展的愿景转化为实际行动。这是一份号召，邀请你将个人职业发展与创造更具韧性、更高效率、更可持续的世界这一宏伟目标紧密相连。 我们正在寻找“影响力创造者”（IMPACT Makers）—— 那些能在自动化、电气化与数字化的交汇点，将可持续发展愿景转化为切实行动的杰出人才。我们推崇每一位“影响力创造者”，并相信每个人都有潜力成为其中一员。 加入施耐德电气，成为“影响力创造者”—— 即刻申请！ 全球营收达 400 亿欧元 有机增长率超 9% 业务遍及 100 多个国家和地区，员工超 15 万人     申请须知 所有岗位均需通过线上申请方可纳入考量。本岗位招聘将持续至合适人选到岗为止。 多元化与包容性承诺 施耐德电气致力于成为全球最具包容性与人文关怀的企业，我们为世界各地的每一个人提供公平的机会，确保所有员工都能感受到独特的价值认同，在安全的环境中全力以赴、贡献所长。我们珍视并反映所运营社区的多元性，“包容” 是我们的核心价值观之一。我们坚信，个体的差异能让企业与个人变得更加强大，我们承诺在一切工作中积极倡导包容性。 道德与合规准则 在施耐德电气，我们坚守最高标准的道德与合规要求，并坚信信任是核心价值基石。《信任宪章》（Trust Charter）是我们的行为准则，彰显了我们在道德、安全、可持续发展、质量及网络安全方面的坚定承诺，为我们业务的方方面面提供支撑，也体现了我们尊重他人、真诚对待所有利益相关方的意愿。你可通过此处了解更多关于《信任宪章》的信息。 平等就业机会声明 施耐德电气是一家倡导平等就业机会的雇主。我们的政策是，在招聘、录用、培训、调动及晋升等各个环节，为所有符合条件的个人提供平等的就业及发展机会，不因种族、宗教、肤色、性别、残疾、国籍、血统、年龄、军籍、性取向、婚姻状况或任何其他受法律保护的特征或行为而产生歧视。