10 Aug
|
Leading
|
Serilingampalle (M)
10 Aug
Leading
Serilingampalle (M)
Role
Overview
The SOC L1
Analyst is responsible for 24x7 security monitoring, alert triage, and initial
investigation across enterprise security tools including SIEM, EDR/XDR, Cloud,
DLP, DAM, and Email Security. The role focuses on early threat detection,
accurate classification, and timely escalation of security incidents in line
with defined SLAs and SOC procedures.
Key
Responsibilities
- Monitor and
triage alerts from SIEM, EDR/XDR, Cloud (Azure/AWS), DLP, DAM, and Email
Security platforms
- Perform
initial validation and classification of alerts (True Positive / False Positive
/ Benign)
- Investigate
common threats such as phishing, malware, brute force attacks, and anomalous
logins etc.
- Conduct IOC
enrichment and basic threat analysis (IP, domain, hash reputation checks)
- Perform basic
endpoint investigation (process tree, file activity, command -line review)
- Analyze email
security alerts, including phishing and header analysis
- Validate DLP
alerts for potential data leakage and DAM alerts for unauthorized database
access
- Create,
update, and manage incident tickets in JIRA with proper documentation
- Follow SOC
playbooks and escalate confirmed incidents to L2 within SLA timelines
- Collaborate
with IT and security teams for incident validation and response support
Required
Qualifications
·
- 2 to 4 years
of experience in a Security Operations Center (SOC) or similar role
- Bachelor’s
degree in Cybersecurity, Computer Science, IT, or related field
- Hands -on
experience with at least one SIEM platform (e.g., Sentinel, Splunk, QRadar) and
EDR/XDR tools (e.g., Microsoft Defender, CrowdStrike, SentinelOne)
- Basic
understanding of cloud security logs (Azure AD, AWS CloudTrail)
- Familiarity
with DLP and DAM concepts
- Knowledge of
email security and phishing analysis techniques
- Relevant
certifications preferred: CompTIA Security+, CEH, CySA+, SC -200
Core
Competencies
- Strong
understanding of networking fundamentals (TCP/IP, DNS, HTTP/S, ports &
protocols)
- Knowledge of
common cyber threats: phishing, malware, ransomware, brute force etc.
- Basic
awareness of MITRE ATT&CK; framework
- Ability to
analyze logs and correlate events across multiple tools
- Positive
understanding of incident triage and escalation workflows
- Strong
analytical thinking and attention to detail
- Effective
communication and documentation skills
- Ability to
work in a 24x7 rotational shift environment