Role Overview - We are looking for Cyber Security Monitoring Engineers L1 to provide continuous security monitoring and first-line incident handling. The role focuses on alert triage, event validation, incident classification, SLA-based escalation, operational reporting, and accurate case management in a 24x7 SOC environment.

Key Responsibilities

- Monitor SIEM, XDR, PAM, endpoint, cloud, network, and application-security alerts across assigned shifts.
- Perform initial triage, validate alerts, collect evidence, classify incidents, assign priority, and follow documented escalation procedures.
- Investigate suspicious authentication, malware, phishing, endpoint, network, privilege, application, and cloud events using approved tools and runbooks.
- Create and update incident tickets with clear timelines, indicators, findings, actions taken, and handover notes.
- Escalate confirmed or complex incidents to L2 or L3 teams within defined notification and response SLAs.
- Monitor Microsoft Sentinel health, log-source availability, connector status, and ingestion delays; report stoppages promptly.
- Track incidents and service requests through Jira or the designated case-management platform.
- Coordinate with application, infrastructure, network, and service owners to obtain information required for investigations.
- Support daily shift handovers, dashboards, KPI reports, audit-evidence collection, and operational reviews.
- Follow and help improve SOPs, runbooks, escalation matrices, communication templates, and knowledge articles.
- Maintain confidentiality and handle security evidence in accordance with approved procedures.

Required Qualifications and Skills

- 2 to 3 years of experience in SOC monitoring,



cyber security operations, infrastructure monitoring, or incident support.
- Hands-on familiarity with a SIEM platform, preferably Microsoft Sentinel, and basic knowledge of KQL or similar query syntax.
- Understanding of common attack techniques, indicators of compromise, phishing, malware, authentication anomalies, and network-security events.
- Basic knowledge of Windows, Linux, TCP/IP, DNS, HTTP/S, firewalls, VPNs, Active Directory, and cloud-security concepts.
- Ability to follow playbooks, prioritize alerts, maintain accurate tickets, and communicate clearly during escalations.
- Willingness to work rotational shifts in a 24x7 security operations workplace.

Preferred Qualifications

- Exposure to Microsoft Defender, EDR/XDR, PAM360, vulnerability-management, email-security, or threat-intelligence tools.
- Experience with Jira, ServiceNow, or another incident and SLA tracking platform.
- Certifications such as SC-200, Security+, CEH, or equivalent foundational security credentials.
- Working knowledge of MITRE ATT&CK; and incident-response lifecycle concepts.

Key Performance Areas

- Alert acknowledgement and triage within SLA
- Accuracy of incident classification and escalation
- Completeness of tickets and shift handovers
- Adherence to SOPs and monitoring coverage

Work Arrangement This is a full-time hybrid position based in Chandigarh. The role will primarily operate from home, with office attendance required for onboarding, workshops, operational needs, stakeholder meetings, or other business requirements. SOC roles may require rotational shifts, weekend coverage, and on-call availability according to the approved roster.

Work Location: In person

📌 Cyber Security Monitoring Engineer (Chandigarh)
🏢 Probill RCM
📍 Chandigarh