SOC L1 Cyber Security Analyst

Role Overview

Security Monitoring and Triage

• Continuously monitor alerts and events from SIEM, EDR, IDS/IPS, and other security tools.
• Analyze and triage alerts to identify potential incidents and determine legitimacy, severity, and impact.
• Use initial investigation and log analysis to distinguish false positives from legitimate threats.
• Categorize and prioritize incidents according to established procedures and severity levels.

Incident Response and Containment

• Act as the first responder and initiate incident response procedures using established playbooks.
• Execute initial containment actions, such as isolating affected systems or endpoints.
• Gather and preserve forensic data and logs for higher-tier analysts.
• Document incident findings and actions accurately and promptly.
• Escalate confirmed incidents and complex investigations to L2 or senior response teams.