SOC Analyst (L1)

About the role

[Company] is hiring entry-level SOC Analysts (L1) to monitor, triage and escalate security alerts in our 24x7 Security Operations Centre. You will work on Rapid7 InsightIDR (SIEM) and SentinelOne (EDR), alongside L2 analysts and the incident response lead.

We hire for strong fundamentals, a clear triage method and fast learning, not for years of experience. We will train you on our stack.

- Experience: Freshers only
- Location: Remote
- Shift: Rotational 24x7
- Reports to: SOC Lead

Key responsibilities

- Monitor and triage alerts from SIEM and EDR: gather context, decide true positive, false positive or benign true positive, and document the evidence
- Enrich indicators (IPs, domains, hashes, URLs) using threat-intel sources such as VirusTotal and AbuseIPDB
- Investigate common incident types: phishing and BEC, brute force and password spraying, suspicious PowerShell, malware on endpoints, impossible-travel sign-ins
- Analyse phishing emails: headers, SPF/DKIM/DMARC results, links and attachments in a sandbox
- Escalate confirmed incidents to L2 with a clear, factual escalation note, within playbook SLAs
- Take first containment actions per playbook, such as isolating a host or disabling an account, under L2 guidance
- Map activity to MITRE ATT&CK; to identify the attack stage and what to check next
- Support vulnerability assessment: run scans, validate findings and help prioritise remediation
- Flag noisy detection rules to the SOC lead for tuning
- Write clear shift handovers and incident summaries for technical and non-technical readers

Must-have requirements

- Bachelor's degree in Computer Science, IT, Electronics or a related field, or equivalent practical experience
- One baseline certification: CompTIA Security+, ISC2 Certified in Cybersecurity (CC) or CompTIA CySA+
- AND demonstrable hands-on blue-team practice, such as BTL1, Certified CyberDefender (CCD), Microsoft SC-200, or a public TryHackMe / LetsDefend / CyberDefenders profile with a completed SOC path (share the link)
- Solid networking basics:



TCP/IP, common ports and protocols (DNS, HTTP/S, SMB, RDP, Kerberos), subnetting
- Windows and Linux fundamentals, including reading Windows Security event logs (e.g. 4624, 4625, 4688) and logon types
- Working knowledge of the MITRE ATT&CK; framework and the incident response lifecycle (NIST SP 800-61)
- Ability to write basic SIEM queries in any language (SPL, KQL, LEQL or similar)
- Clear written English: able to write a concise escalation note and a summary for a non-technical manager
- Willingness to work rotational shifts

Good to have

- A SOC internship of 36 months (MSSP or in-house) where you personally triaged real alerts. Tell us which SIEM, how many alerts per shift and what you escalated
- A home lab you can describe in detail, e.g. Wazuh, Security Onion, Splunk Free or Elastic, with Sysmon on a Windows VM and attacks simulated using Atomic Red Team
- Blue-team CTF participation, write-ups, or a GitHub repo with detection rules, queries or scripts
- Scripting in Python or PowerShell to parse logs or automate lookups
- CCNA or CompTIA Network+, or Splunk Core Certified User / Power User
- Exposure to Rapid7 InsightIDR, SentinelOne, Microsoft Defender, Qualys, Nessus or OpenVAS
- Awareness of current threats (ransomware, infostealers, AiTM phishing, ClickFix lures) and where you follow them, e.g. CISA KEV, CERT-In advisories, The DFIR Report

Vendor certifications (Rapid7, SentinelOne) are a bonus, not a requirement. Offensive certifications such as CEH or OSCP are not required for this role.

What we offer

- Structured onboarding: vendor training on Rapid7 InsightIDR and SentinelOne within your first 90 days
- Mentoring from L2 analysts and a clear growth path from L1 to L2 and L3 (threat hunting, detection engineering, incident response)
- Hands-on exposure to real incidents across email, identity, endpoint and cloud Role & responsibilities

Mandatory Requirements

- Must be willing to work in night shifts.
- 5 Days work and 2 Days off.
- Must have descent English communication skills.
- Must have positive security knowledge and required certification mentioned above.

📌 Soc Analyst 1 (Delhi)
🏢 Paramarsh Informatics
📍 Delhi