Description

You will monitor, investigate, and respond to security incidents within the Security Operations Center.

This role is hybrid.

Responsibilities

• Monitor and triage alerts from SIEM, EDR, and NDR tools, distinguishing false positives from true positives.
• Investigate incidents to validate severity, scope, and potential impact using attack telemetry.
• Collaborate with senior staff to escalate complex cases requiring deep forensic analysis.
• Update and refine incident response playbooks based on postmortems and emerging threats.
• Prepare detailed incident reports for internal stakeholders and document findings in case management systems.

Required Skills

• 2–5 years of experience in cybersecurity operations, incident response, or a SOC environment.
• Strong understanding of Incident Response Lifecycle (NIST 800-61 or similar frameworks) and threat intelligence correlation.
• Proficiency with SIEM platforms (e.g., Splunk, Microsoft Sentinel) and EDR tools (e.g., CrowdStrike, Microsoft Defender).
• Knowledge of network protocols including TCP/IP, DNS, and HTTP.
• Familiarity with Active Directory, Azure AD, and identity management concepts.
• Scripting knowledge using PowerShell or Python for automation and data parsing.
• Ability to contain and remediate incidents using established playbook practices.
• Experience with threat intelligence sources, IOCs, and MITRE ATT&CK.

Preferred Skills

• Bachelor’s degree in Cybersecurity, Information Technology, or Computer Science.
• Familiarity with SOAR automation for incident response workflows.
• Experience with cloud security concepts in Azure or AWS.

Key Skills

Education

Any Gradute