Description

Key Responsibilities

• Monitor security alerts and events from SIEM, EDR, and other security monitoring tools.
• Perform initial alert triage, investigation, and classification.
• Analyze logs and security events to identify suspicious or malicious activity.
• Investigate common security incidents such as phishing, malware, suspicious logins, endpoint alerts, and unauthorized access.
• Escalate complex or confirmed security incidents to L2/L3 SOC analysts according to established procedures.
• Create and maintain accurate incident tickets and investigation documentation.
• Follow SOC playbooks, escalation procedures, and incident response processes.
• Monitor network, endpoint, identity, and application security events.
• Assist with basic threat intelligence and IOC investigation.
• Correlate security events across multiple sources to identify potential threats.
• Support incident response activities and provide timely status updates.
• Maintain awareness of emerging cybersecurity threats and vulnerabilities.
• Work closely with L2/L3 analysts, incident response, infrastructure, and other security teams.

Required Skills

• 1–3+ years of experience in a SOC, cybersecurity, security monitoring, or related role.
• Hands-on experience with SIEM tools such as Splunk, Microsoft Sentinel, QRadar, or similar.
• Understanding of TCP/IP, DNS, HTTP/HTTPS, VPN, firewalls, and networking fundamentals.
• Knowledge of common cybersecurity threats including phishing, malware, ransomware, brute-force attacks, and credential attacks.
• Experience analyzing Windows/Linux security logs.
• Basic understanding of EDR/XDR concepts and tools.
• Knowledge of MITRE ATT&CK framework and common attack techniques.
• Familiarity with IOC analysis, including IP addresses, domains, URLs, and file hashes.
• Strong analytical and troubleshooting skills.
• Good written and verbal communication skills.
• Ability to work in a 24x7 SOC environment, including shifts when required.

Preferred Skills

• Experience with Splunk Enterprise Security, Microsoft Sentinel, CrowdStrike, Defender, QRadar, or similar tools.
• Security certifications such as Security+, CySA+, GSEC, or CEH.
• Familiarity with basic incident response and threat hunting.
• Understanding of cloud security concepts, particularly AWS or Azure.
• Experience working with SOC playbooks and documented escalation procedures

Key Skills

Education

Any Gradute