Security Operations Engineer

Role Summary

The SOC Analyst (L1) is responsible for monitoring, detecting, triaging, and escalating security events generated from enterprise security tools. The role provides hands-on exposure to security operations, incident investigation, threat monitoring, phishing analysis, and cybersecurity defense activities in a 24x7 Security Operations Center environment.

Key Responsibilities

Security Monitoring & Alert Management

• Hands-on experience with Crowdstrike NG-SIEM, Proofpoint and CrowdStrike Query Language (CQL)
• Monitor security alerts generated from SIEM, EDR, Email Security, and Network Security platforms.
• Perform initial triage and analysis of security events.
• Identify false positives and escalate genuine security incidents.
• Follow SOC runbooks and standard operating procedures.

Incident Handling

• Investigate suspicious activities, malware alerts, phishing attempts, and account compromise events.
• Document findings, actions taken, and incident details.
• Assist senior analysts during incident response activities.

Threat Analysis

• Review indicators of compromise (IOCs).
• Correlate security events from multiple data sources.
• Support threat intelligence enrichment activities.

Reporting & Documentation

• Maintain accurate shift handover notes.
• Update incident tickets within SLA requirements.
• Create investigation summaries and operational reports.

Required Skills

• Hands-on experience with CrowdStrike NG-SIEM, Proofpoint, and CrowdStrike Query Language (CQL)
• Knowledge of Networking fundamentals (TCP/IP, DNS, HTTP, HTTPS).
• Understanding of Windows and Linux operating systems.
• Familiarity with security concepts such as malware, phishing, ransomware, and vulnerabilities.
• Good analytical and problem-solving skills.
• Strong written and verbal communication skills.

Educational Qualification

B.Tech / BE / BCA / MCA / BSc (Computer Science, IT, Cybersecurity)

Cybersecurity certifications preferred

Security+

SC-900

Key Success Metrics

• Alert triage accuracy
• SLA adherence
• Incident documentation quality
• Continuous learning and certification progress