The posting
Key Responsibilities Security Monitoring & Incident Analysis and Response Monitor security events and alerts generated from SIEM, EDR, NDR, IDS/IPS, firewalls, and other security technologies. Perform 24x7 security monitoring and threat detection activities. Analyze security logs and identify suspicious activities, attack patterns, and potential threats. Validate alerts and distinguish true positives from false positives. Participate in threat hunting activities and proactive investigations. Investigate cybersecurity incidents and conduct root cause analysis. Assess the scope, impact, severity, and business risk of security incidents. Lead or support incident response activities including containment, eradication, recovery, and post-incident analysis. Develop incident reports, investigation findings, and executive summaries. Follow established incident response procedures, playbooks, and SOPs. SIEM and SOAR Platform Administration Manage and maintain SIEM and SOAR platforms and associated security monitoring tools. Configure and optimize log collection, parsing, normalization, and correlation rules. Ensure security logs are properly onboarded and monitored. Troubleshoot log ingestion and data quality issues. Improve monitoring coverage and visibility across enterprise environments. Design, develop, and maintain SIEM use cases and correlation rules. Create new detection content based on emerging threats, threat intelligence, and attack techniques. Continuously optimize detection rules to improve accuracy and reduce false positives. Map detection use cases to the MITRE ATT&CK framework. Develop and maintain security monitoring documentation and operational runbooks. Collaboration & Communication Coordinate with IT, infrastructure, application, cloud, and business teams during incident investigations. Facilitate communication between stakeholders during security incidents. Provide technical guidance and recommendations on security remediation actions. Present investigation findings and security recommendations to management. Support security awareness programs, tabletop exercises, and incident response drills. Qualifications • Bachelor’s degree in computer science, information security, or related technical discipline or equivalent professional experience related to Cybersecurity, Incident Response or information security. Relevant security-related certifications a plus : CISSP, CISP, CEH, Security+ etc. • 3+ years of Security Operations Center (SOC) work experience with a Bachelor’s degree • 5+ years of related experience in Cybersecurity or computer network defense role. • Proven subject matter ability in relevant areas, such as incident response, intrusion analysis, malware analysis, web application security or security engineering. • Solid understanding of TCP/IP and internetworking technology including packet analysis, routing and network security defenses. • Strong knowledge of operating systems (Windows & Linux), network services and applications, malware families and network attack vectors. • Demonstrated experience in an enterprise-level incident response team or security operations center. Direct experience in handling cyber security incidents and associated incident response tools. • Experience in operating and utilizing Security Information and Event Management and SOAR tools .Relevant tools experience is plus: MS sentinel, CP4S etc. • Strong working knowledge of common security tools such as SIEM, AV, WAF, IDS, Netflow, Packet Analyzer and Endpoint Detection & Response tools. • Experience in SIEM and SOAR administration, Log onboarding and integration, Correlation rule development, Use case design and implementation, security Automation. • Display great problem solving skills, with tenacity and resilience to resolve issues. • Excellent communication and presentation skills with proven skill in presenting analytical data effectively to varied audiences. • Strong interpersonal and leadership skills to influence and build credibility as a peer. • Strong understanding of cloud technologies and related security best practices. 这对我有什么好处? 从事有意义的工作,保护系统、运营和客户免受真实威胁 通过认证、专业培训和导师指导机会实现职业发展 协作文化,你的专业知识直接影响安全策略 旨在支持平衡和身心健康的灵活工作选择 将你的网络安全专业知识带到一个重视你影响力的团队——立即申请! 为您量身打造的回报 我们的全方位奖励体现了我们对您的重视。这不仅是薪酬和福利—it是对您的重要投资。该方案旨在支持您的表现、成长、安全感和潜能提升。它帮助您照顾自己和家人、规划未来、提升技能与职业发展、在包容的环境中协作，并为社区作出贡献。在施耐德电气，我们始终关注对您最重要的事情。欢迎访问我们的 职业发展页面 了解更多。 * 不同国家和地区可能适用不同的计划与项目。 你是否渴望让自己的职业生涯产生深远影响？ 当你考虑加入一个新团队时，企业文化至关重要。在施耐德电气，我们的价值观与行为准则是构建卓越文化、助力业务成功的基石。我们坚信，“IMPACT” 核心价值观—— 包容（Inclusion）、精进（Mastery）、使命（Purpose）、力行（Action）、求知（Curiosity）、共赢（Teamwork）—— 源于每一位成员的践行。 “IMPACT” 更是我们向你的诚挚邀约：无论你身处何种岗位，都能在施耐德电气将可持续发展的愿景转化为实际行动。这是一份号召，邀请你将个人职业发展与创造更具韧性、更高效率、更可持续的世界这一宏伟目标紧密相连。 我们正在寻找“影响力创造者”（IMPACT Makers）—— 那些能在自动化、电气化与数字化的交汇点，将可持续发展愿景转化为切实行动的杰出人才。我们推崇每一位“影响力创造者”，并相信每个人都有潜力成为其中一员。 加入施耐德电气，成为“影响力创造者”—— 即刻申请！ 全球营收达 400 亿欧元 有机增长率超 9% 业务遍及 100 多个国家和地区，员工超 15 万人 申请须知 所有岗位均需通过线上申请方可纳入考量。本岗位招聘将持续至合适人选到岗为止。 多元化与包容性承诺 施耐德电气致力于成为全球最具包容性与人文关怀的企业，我们为世界各地的每一个人提供公平的机会，确保所有员工都能感受到独特的价值认同，在安全的环境中全力以赴、贡献所长。我们珍视并反映所运营社区的多元性，“包容” 是我们的核心价值观之一。我们坚信，个体的差异能让企业与个人变得更加强大，我们承诺在一切工作中积极倡导包容性。 道德与合规准则 在施耐德电气，我们坚守最高标准的道德与合规要求，并坚信信任是核心价值基石。《信任宪章》（Trust Charter）是我们的行为准则，彰显了我们在道德、安全、可持续发展、质量及网络安全方面的坚定承诺，为我们业务的方方面面提供支撑，也体现了我们尊重他人、真诚对待所有利益相关方的意愿。你可通过此处了解更多关于《信任宪章》的信息。 平等就业机会声明 施耐德电气是一家倡导平等就业机会的雇主。我们的政策是，在招聘、录用、培训、调动及晋升等各个环节，为所有符合条件的个人提供平等的就业及发展机会，不因种族、宗教、肤色、性别、残疾、国籍、血统、年龄、军籍、性取向、婚姻状况或任何其他受法律保护的特征或行为而产生歧视。
