Description:
The Cybersecurity group at KLA is involved in every aspect of the global business. The KLA Cybersecurity group defends against cyber-attacks and provides cybersecurity tools, incident response services and assessment capabilities to safeguard the environments that support the essential operations of KLA. We are passionate about identifying adversarial activities and anticipating a wide variety of threats to strengthen our defenses and the overall protection of KLA Intellectual Property.
The SOC Analyst is responsible for incident response, threat hunting, and maintaining the security tools that are used to secure our environment. This individual will have a specific focus on Incident Response, tuning detection rule-sets, and generating and responding to tickets across relevant IT and Cybersecurity teams.
Essential Duties and Responsibilities:
- Participate as an active member of the team that monitors and processes security events on a 24x7 basis.
- Security alert monitoring, triage, and analysis to prioritize and differentiate between potential intrusion attempts and false alarms.
- Actively preform detection, monitoring, analysis, and resolution of security incidents.
- Must be able to prioritize their own work and tasks for response
- Participate in the execution of regular incident response and postmortem exercises.
- Facilitate the development and tuning of AV, EDR, SIEM, and DLP rules to ensure high fidelity alerting.
- Communication with management as the need arises: keeping informed of incident progress, notifying of impending changes or agreed outages.
- Generate reports from different data sources and present to management as required.
- Must be able to maintain awareness of trends in security regulatory, technology, and operational requirements.
Additional Duties And Responsibilities
- Some domestic and/or international travel (up to 10%) may be required.
- Ability to communicate clearly with other team members
Minimum Qualifications
- Extensive related experience in cybersecurity or related technologies such as: firewalls/AV/EDR/IPS/IDS/SIEM, and forensic tools.
- Experience working in or with a Security Operations Center (SOC) in an Incident Responder role.
- Proficiency in Operating Systems (Windows/Linux/Mac).
- Technical awareness: ability to match resources to technical issues appropriately.
Preferred Qualifications:
- Bachelor's Degree or equivalent experience in an Information Security/related IT field.
- Relevant security related certification(s) a plus: CISSP, GCIA, GSEC, GCIH, GCED, GCFA, GREM.