SOC Analyst

We are seeking a skilled and proactive Senior SOC Operations Analyst to join our cybersecurity operations team. The ideal candidate will bring in-depth experience in working with SIEM, XDR tools, incident response processes, and phishing analysis. This role will be responsible for monitoring, detecting, analyzing, and responding to cybersecurity incidents, with a focus on threat detection, automation, and continuous improvement of SOC operations.

1. SIEM Operations and Monitoring

- Monitor, investigate, and analyze logs and alerts generated by SIEM tools such as Microsoft Sentinel, Splunk, and LogRhythm.

- Perform log correlation and filtering to identify malicious patterns and reduce false positives.

- Understand and modify existing correlation rules and develop use cases to detect anomalies and security events.

- Analyze various log sources including Windows Event Logs, Firewall, Proxy, VPN, DNS, and other security infrastructure logs.

1. XDR Investigation and Threat Hunting

- Utilize Extended Detection and Response (XDR) platforms such as Trend Micro Vision One, CrowdStrike Falcon, and Microsoft Defender for Endpoint.

- Conduct endpoint investigations, analyze process behavior, service activity, and network connections.

- Block known Indicators of Compromise (IOCs), investigate suspicious behavior, and recommend containment actions.

- Monitor for lateral movement, persistence techniques, and privilege escalations.

1. Incident Response and Escalation

- Triage alerts by categorizing and prioritizing incidents (malware, unauthorized access, data leakage, etc.).

- Respond to security incidents and determine scope, impact, severity, and root cause.





- Document incident findings and escalate to appropriate stakeholders per defined processes and SLAs.

- Collaborate with other IT and security teams for containment, eradication, and recovery.

1. Phishing and Email Threat Analysis

- Analyze suspected phishing/spam emails including header analysis, embedded links, attachments, and URLs.

- Perform domain/IP reputation checks using threat intelligence platforms.

- Work closely with email administrators and security teams to block malicious senders and educate users.

1. Security Analysis and Threat Validation

- Use open-source tools and threat intelligence feeds to validate IOCs and assess their impact.

- Identify vulnerabilities and suspicious behavior related to malware, fileless attacks, or command execution.

- Maintain awareness of evolving threat actor techniques and indicators.

1. Scripting and Automation Awareness

- Detect and review suspicious scripts for embedded commands, credential theft, and persistence mechanisms.

- Identify common scripting languages used in attacks (PowerShell, Bash, Python).

- Contribute to playbook development and automation initiatives within the SOC.

1. Networking and Security Fundamentals

- Understand IP addressing, port protocols (TCP/UDP), DNS, HTTP/HTTPS, and VPN tunnels.

- Differentiate between internal and external traffic and identify unusual network behavior.

- Correlate network-based alerts with endpoint and application data for full-context analysis.

Tools & Technologies:

- SIEM: Forescout, Splunk

- XDR/EDR: Trend Vision One, CrowdStrike

- Email Security: TrendMicro Email Gateway, KnowBe4

- Scripting: PowerShell, Python (basic code understanding)

- Open-Source: VirusTotal, URLscan, AbuseIPDB, Shodan, Hybrid Analysis

- Ticketing: ServiceNow

- Threat Intelligence: MISP, AlienVault OTX, IBM X-Force Exchange

📌 Soc Analyst (Bengaluru)
🏢 Tata Consultancy Services
📍 Bengaluru