SOC Analyst

Requirements

• Security Monitoring
• Monitor SIEM dashboards (e.g., Microsoft Sentinel) and security alerts in real time.
• Track and analyze events from security tools (eg . Microsoft Defender)
• Identify suspicious activities, anomalies, or policy violations.
• Incident Triage & Response
• Perform initial investigation and classification of alerts (false positive vs true positive).
• Collect and review logs, event details, reputation information, and indicators of compromise.
• Escalate confirmed or high-severity incidents to L2/L3 analysts with proper documentation.
• Initiate predefined response actions (isolating devices, forcing password resets, blocking IPs).
• Threat Analysis
• Check IOC hits against threat intelligence sources.
• Analyze phishing emails, malware infections, malicious URLs, attachments, credential-harvesting attempts and unauthorized access.
• Identify trends across alerts to support early-stage threat detection.
• Documentation & Reporting
• Create detailed incident tickets and investigation notes.
• Conduct root cause analysis and document incident reports with remediation recommendations.
• Maintain proper incident timelines and updates in the ticketing system.
• Generate reports for repeated or trending issues.
• Collaboration
• Work closely with Security Team and internal IT teams.
• Communicate effectively with users to validate suspicious activities or login attempts.
• Follow established SOPs and contribute to process improvements.
• Security Awareness and Training
• Conduct security awareness training for employees to promote best practices (e.g., password management, phishing prevention).
• Create and distribute educational materials on emerging cyber threats.
• Threat Intelligence and Research:
• Stay updated on the latest cyber threats, vulnerabilities, and attack vectors.
• Analyze threat intelligence reports and apply findings to enhance organizational security posture.