Job description
Role Overview The SOC L1 Analyst is responsible for 24x7 security monitoring, alert triage, and initial investigation across enterprise security tools including SIEM, EDR/XDR, Cloud, DLP, DAM, and Email Security. The role focuses on early threat detection, accurate classification, and timely escalation of security incidents in line with defined SLAs and SOC procedures.
Key Responsibilities
Monitor and triage alerts from SIEM, EDR/XDR, Cloud (Azure/AWS), DLP, DAM, and Email Security platforms Perform initial validation and classification of alerts (True Positive / False Positive / Benign) Investigate common threats such as phishing, malware, brute force attacks, and anomalous logins etc. Conduct IOC enrichment and basic threat analysis (IP, domain, hash reputation checks) Perform basic endpoint investigation (process tree, file activity, command-line review) Analyze email security alerts, including phishing and header analysis Validate DLP alerts for potential data leakage and DAM alerts for unauthorized database access Create, update, and manage incident tickets in JIRA with proper documentation Follow SOC playbooks and escalate confirmed incidents to L2 within SLA timelines Collaborate with IT and security teams for incident validation and response support Required Qualifications
- 2 to 4 years of experience in a Security Operations Center (SOC) or similar role Bachelor’s degree in Cybersecurity, Computer Science, IT, or related field Hands-on experience with at least one SIEM platform (e.g., Sentinel, Splunk, QRadar) and EDR/XDR tools (e.g., Microsoft Defender, Crowd. Strike, Sentinel. One) Basic understanding of cloud security logs (Azure AD, AWS Cloud. Trail) Familiarity with DLP and DAM concepts Knowledge of email security and phishing analysis techniques Relevant certifications preferred: CompTIA Security+, CEH, CySA+, SC-200 Core Competencies Strong understanding of networking fundamentals (TCP/IP, DNS, HTTP/S, ports & protocols) Knowledge of common cyber threats: phishing, malware, ransomware, brute force etc. Basic awareness of MITRE ATT&CK framework Ability to analyze logs and correlate events across multiple tools Good understanding of incident triage and escalation workflows Strong analytical thinking and attention to detail Effective communication and documentation skills Ability to work in a 24x7 rotational shift environment