Description
Our client's Security Operations Center (SOC) currently monitors approximately 65,000 global organisations, 2 million endpoints, and 3 million mailboxes/users from 3 SOC locations. The SOC Analyst 1 serves as an initial triage and alert review point for security events and alerts from our security tools.
Key Responsibilities:
- Investigate security alerts and suspicious activities from our client’s own security stack, 3rd party tools, and cloud platforms.
- Perform detailed investigations into security alerts, attacker techniques, and identify emerging threats.
- Correlate events from multiple security tools and data sources to determine risk, business impact, and required remediation actions.
- Assist with developing and maintaining detection rules, use cases, playbooks, and response procedures.
- Validate security events and reduce false positives through tuning and optimisation of monitoring tools.
- Assist with preparing post-event reports, executive summaries, and technical documentation.
- Stay current on threat intelligence, attacker tactics, techniques, and procedures (TTPs), and emerging cybersecurity trends.
Required Qualifications:
- At least 1 year of experience in a Security Operations Centre, Incident Response, or Cybersecurity Analyst role.
- Experience investigating security events across endpoint, network, and cloud platforms.
- Strong understanding of cybersecurity frameworks such as NIST, MITRE ATT&CK, CIS Controls, and Cyber Kill Chain.
- Hands-on experience with SIEM platforms such as Microsoft Sentinel, Splunk, QRadar, or LogRhythm.
- Experience with endpoint detection and response (EDR) solutions such as Microsoft Defender for Endpoint, CrowdStrike, SentinelOne, or Carbon Black.
- Knowledge of networking protocols, operating systems, authentication technologies, and cloud security concepts.
- Strong analytical, troubleshooting, and problem-solving skills.
- Excellent written and verbal communication skills.
Success Measures:
- Timely identification and resolution of security incidents.
- Reduction of false-positive alerts through continuous tuning.
- Improvement of detection coverage and threat visibility.
- Contributions to security process improvements, team education, and operational maturity.