Role Overview The SOC L1 Analyst is responsible for 24x7 security monitoring, alert triage, and initial investigation across enterprise security tools including SIEM, EDR/XDR, Cloud, DLP, DAM, and Email Security. The role focuses on early threat detection, accurate classification, and timely escalation of security incidents in line with defined SLAs and SOC procedures.

Key Responsibilities

- Monitor and triage alerts from SIEM, EDR/XDR, Cloud (Azure/AWS), DLP, DAM, and Email Security platforms

- Perform initial validation and classification of alerts (True Positive / False Positive / Benign)

- Investigate common threats such as phishing, malware, brute force attacks, and anomalous logins etc.

- Conduct IOC enrichment and basic threat analysis (IP, domain, hash reputation checks)

- Perform basic endpoint investigation (process tree, file activity, command-line review)

- Analyze email security alerts, including phishing and header analysis

- Validate DLP alerts for potential data leakage and DAM alerts for unauthorized database access

- Create, update, and manage incident tickets in JIRA with proper documentation

- Follow SOC playbooks and escalate confirmed incidents to L2 within SLA timelines





- Collaborate with IT and security teams for incident validation and response support

Required Qualifications

·

- 2 to 4 years of experience in a Security Operations Center (SOC) or similar role

- Bachelor’s degree in Cybersecurity, Computer Science, IT, or related field

- Hands-on experience with at least one SIEM platform (e.g., Sentinel, Splunk, QRadar) and EDR/XDR tools (e.g., Microsoft Defender, CrowdStrike, SentinelOne)

- Basic understanding of cloud security logs (Azure AD, AWS CloudTrail)

- Familiarity with DLP and DAM concepts

- Knowledge of email security and phishing analysis techniques

- Relevant certifications preferred: CompTIA Security+, CEH, CySA+, SC-200

Core Competencies

- Robust understanding of networking fundamentals (TCP/IP, DNS, HTTP/S, ports & protocols)

- Knowledge of common cyber threats: phishing, malware, ransomware, brute force etc.

- Basic awareness of MITRE ATT&CK; framework

- Ability to analyze logs and correlate events across multiple tools

- Good understanding of incident triage and escalation workflows

- Strong analytical thinking and attention to detail

- Effective communication and documentation skills

- Ability to work in a 24x7 rotational shift environment

📌 Security Analyst (Serilingampalle (M))
🏢 NopalCyber
📍 Serilingampalle (M)