SOC Analyst (L1.5)

Job Summary

We are looking for a SOC Analyst (L1.5) with hands-on experience in Security Operations, Security Monitoring, Incident Response, Threat Hunting, and SIEM technologies. The ideal candidate should have exposure to Logpoint SIEM and strong experience in handling security incidents, alert triage, and threat investigations in a 24x7 SOC environment.

Candidates with strong experience in Microsoft Sentinel, Splunk, QRadar, or ArcSight along with incident response and threat hunting capabilities will also be considered.

Security Monitoring & Incident Detection

• Monitor and analyze security alerts generated from SIEM and integrated security tools.
• Perform real-time alert triage and validate security incidents.
• Investigate incidents related to malware, phishing, ransomware, insider threats, account compromise, privilege misuse, and unauthorized access.
• Escalate incidents to L2/L3 teams as per defined processes.
• Ensure adherence to incident response SLAs and SOC procedures.

Incident Response & Investigation

Perform incident investigation and root cause analysis.

Cloud Platforms (Azure, AWS, GCP)

Support containment, eradication, recovery, and remediation activities.

Document incidents, findings, and recommendations.

Threat Hunting & Threat Intelligence

• Perform proactive threat hunting activities.
• Utilize MITRE ATT&CK Framework for threat mapping and analysis.
• Analyze Indicators of Compromise (IOC) and Indicators of Attack (IOA).
• Correlate threat intelligence with internal security events.
• Identify suspicious user and system behavior.

SIEM Operations

• Monitor and manage Logpoint SIEM use cases and alerts.
• Support correlation rule tuning and alert optimization.
• Create and maintain dashboards, reports, and custom searches.
• Validate log ingestion and monitor SIEM health.
• Reduce false positives through continuous tuning activities.

Required Technical Skills

SIEM Technologies

Logpoint SIEM (Preferred)

Microsoft Sentinel

Splunk

IBM QRadar

ArcSight

Security Technologies

Microsoft Defender

CrowdStrike

SentinelOne

Palo Alto

Fortinet

Check Point

Cisco Security Solutions

IDS/IPS

Email Security Solutions

Threat & Security Operations

Security Monitoring

Incident Response

Alert Triage

Incident Investigation

Threat Hunting

Threat Intelligence

Malware Analysis

Phishing Investigation

Event Correlation

Root Cause Analysis

Operating Systems & Networking

Windows Administration

Linux Administration

TCP/IP

DNS

DHCP

VPN

HTTP/HTTPS

SMTP

Network Security Concepts

Security Frameworks

MITRE ATT&CK

Cyber Kill Chain

NIST Incident Response Lifecycle

Threat Intelligence Concepts

• Bachelor's Degree in Computer Science, Information Technology, Cyber Security, or related field.
• 3+ years of SOC Operations experience.
• Experience working in a 24x7 SOC environment.
• Strong analytical and troubleshooting skills.
• Good verbal and written communication skills.

Splunk Certifications

Ideal Candidate

• 3-6 years of SOC experience.
• Hands-on exposure to Logpoint SIEM is highly desirable.
• Strong experience with Microsoft Sentinel, Splunk, QRadar, or ArcSight.
• Experience in Incident Response, Alert Triage, Threat Hunting, Security Monitoring, and Threat Intelligence.
• Exposure to CrowdStrike, Defender, SentinelOne, Palo Alto, or Fortinet.
• Willingness to work from Hyderabad in 24x7 rotational shifts.

Key Responsibilities

Security Monitoring & Incident Detection

• Monitor and analyze security alerts generated from SIEM and integrated security tools.
• Perform real-time alert triage and validate security incidents.
• Investigate incidents related to malware, phishing, ransomware, insider threats, account compromise, privilege misuse, and unauthorized access.
• Escalate incidents to L2/L3 teams as per defined processes.
• Ensure adherence to incident response SLAs and SOC procedures.

Incident Response & Investigation

Perform incident investigation and root cause analysis.

Analyze logs from

Windows Servers & Workstations

Linux Systems

Active Directory

Firewalls

IDS/IPS

EDR/XDR Solutions

Proxy & Email Security Platforms

Cloud Platforms (Azure, AWS, GCP)

Support containment, eradication, recovery, and remediation activities.

Document incidents, findings, and recommendations.

Threat Hunting & Threat Intelligence

• Perform proactive threat hunting activities.
• Utilize MITRE ATT&CK Framework for threat mapping and analysis.
• Analyze Indicators of Compromise (IOC) and Indicators of Attack (IOA).
• Correlate threat intelligence with internal security events.
• Identify suspicious user and system behavior.

SIEM Operations

• Monitor and manage Logpoint SIEM use cases and alerts.
• Support correlation rule tuning and alert optimization.
• Create and maintain dashboards, reports, and custom searches.
• Validate log ingestion and monitor SIEM health.
• Reduce false positives through continuous tuning activities.
• Bachelor's Degree in Computer Science, Information Technology, Cyber Security, or related field.
• 3+ years of SOC Operations experience.
• Experience working in a 24x7 SOC environment.
• Strong analytical and troubleshooting skills.
• Good verbal and written communication skills.

Preferred Certifications

SC-200 (Microsoft Security Operations Analyst)

CEH

CompTIA Security+

Logpoint Certified Analyst

Splunk Certifications