Security Operations Center Analyst

Job Description:

• SOC Analyst would be part of 24x7 including weekends and national holidays, Security Operation Centre function to perform security monitoring and incident response.

• Responsible for monitoring security events and alerts in real time on the SIEM dashboard during assigned shifts, while also performing initial triage to validate, classify severity levels, and determine whether an event is a true positive or a false positive.

• Log analysis and investigation using SIEM, EDR, IDS, NDR, and firewalls.

• Ensure that no alerts with a severity of High or Critical are missed or exceed the specified response time (SLA).

• Responsible for accurately and systematically creating and managing incident tickets on the case management platform, as well as escalating incidents to a Level 2 SOC Analyst in accordance with the applicable playbook. The escalation process involves compiling a summary of initial findings that includes threat indicators, a timeline of events, and affected assets.

• Conduct a structured shift handover to the next shift's analyst, covering ongoing incidents (open cases) and operational issues.

• Disciplined in following established Standard Operating Procedures (SOPs) and playbooks.

• Communicating and collaborating effectively with internal cross-functional teams to coordinate mitigation actions and ensure complete incident resolution.

• Preparing daily, weekly, and monthly reports in a timely manner regarding monitoring activities, alert counts, and handled incidents.

Requirements:

• Minimum Bachelor's degree in Computer Science.

• Minimum 1-2 years of experience in SOC or IT Security Operations.

• Collaborate with team members to respond to security incidents.

• Knowledgeable in Windows, OS X, and Linux operating systems.

• Good written and verbal communication skills, including the ability to explain technical security incidents and recommendations clearly to non-technical stakeholders.

• Ability to read and analyze logs & alerts, and perform initial incident triage

• Have experience in using monitoring tools such as SIEM,EDR, IDS, NDR, and firewalls.

• Familiar with the MITRE framework, concepts of information security (CIA Triad) and common types of attacks (phishing, brute force, malware, DDoS).

• Good analytical skills and attention to detail.

• Willing to work in shifts.