Role Purpose: The SOC Incident Analyst will monitor security events, investigate alerts and respond to cyber security incidents affecting the organization. The role is accountable for identifying threats, conducting analysis and supporting remediation activities to reduce cyber risk. The role will contribute to maintaining a robust security monitoring capability and improving the organization’s cyber defense posture.

Role Accountability:

Alert Monitoring, Triage & Investigation

1. Monitor security alerts from SIEM, EDR/XDR, email security, web security, identity, cloud and other monitoring platforms.
2. Perform initial triage of alerts to determine severity, validity, affected assets, user context and potential business impact.
3. Investigate incidents by correlating logs, telemetry, threat intelligence and security events to determine scope, root cause and impact.
4. Identify indicators of compromise, suspicious behaviors, policy violations and potential attack patterns during investigations.

Incident Response & Escalation Support

1. Escalate high-severity incidents to SOC leads or incident response teams with clear evidence, impact assessment and containment recommendations.
2. Execute approved response playbooks under supervision, including IOC blocking, account disablement, endpoint isolation and access reset actions.
3. Coordinate with IT, infrastructure, application and identity teams for remediation actions such as patching, configuration changes and access corrections.
4. Maintain shift handover notes and investigation continuity to ensure open cases are tracked and acted upon without delay.

Documentation, Tuning & Continuous Improvement

1. Document incidents with timelines, evidence, affected systems, actions taken, escalation details and closure notes for audit and post-incident reviews.
2. Support alert tuning by providing feedback on false positives, missed detections,



recurring alerts and monitoring gaps.
3. Participate in tabletop exercises, purple-team drills and SOC process improvement activities to strengthen response readiness.
4. Maintain awareness of emerging threats, attack techniques and SOC procedures to improve triage quality and investigation effectiveness.

Measures of Success

1. Security alerts are triaged accurately within defined timelines.
2. Incidents are investigated with transparent evidence, impact assessment and escalation notes.
3. High-severity cases are escalated promptly with actionable containment recommendations.
4. Approved response playbooks are followed consistently during containment and remediation.
5. Incident records include complete timelines, artefacts, actions and closure details.
6. Shift handovers maintain continuity of open investigations.
7. Feedback from investigations helps reduce false positives and improve detection quality.

Technical Skills

1. Incident Response, Investigation & Crisis Handling
2. AI Security Testing, Threat Monitoring & Abuse Detection
3. Detection Engineering, Telemetry, SIEM/XDR Data & Use-Case Lifecycle Management
4. SOC Monitoring & Alert Triage & Incident Operations
5. Security Platform Operations, DLP & Automation
6. Threat, Vulnerability & Exposure Management

Exposure to below mentioned Technologies / Frameworks / Methodologies

1. Microsoft Sentinel
2. Splunk
3. QRadar
4. Defender XDR
5. CrowdStrike Falcon
6. Email security consoles
7. Web security consoles
8. ServiceNow SecOps
9. KQL / SPL
10. IOC analysis
11. Incident playbooks
12. Log correlation
13. Case documentation methods
14. CASB

Qualification: Bachelor’s degree / B.E. / B.Tech / BCA / B.Sc. / MCA in Computer Science, Information Technology, Cyber Security, Information Systems or related discipline.

Preferred Industry: BFSI, payments, banking, fintech, large enterprises with SIEM / EDR monitoring, alert triage, incident handling and security operations exposure.

📌 Manager SOC Incident (Bengaluru)
🏢 Sbi Card
📍 Bengaluru