SOC Analyst

Job summary

Monitor and analyze security alerts, logs, and endpoint activity to identify, investigate, classify, and prioritize potential threats and incidents. Document investigations, maintain incident tickets and reports, follow response procedures, and escalate critical incidents while collaborating with IT and security teams.

Job details

Roles and Responsibilities Monitor security events and alerts using Security Information and Event Management (SIEM) tools. Analyze security logs from firewalls, servers, endpoints, and network devices. Identify and investigate suspicious activities, potential threats, and security incidents. Perform initial alert triage, classification, and prioritization based on severity. Investigate phishing attacks, malware infections, brute-force attempts, and unauthorized access. Analyze IP addresses, URLs, domains, and file hashes to identify potentially malicious indicators. Monitor endpoint security alerts using Endpoint Detection and Response (EDR) tools. Escalate high-priority and critical security incidents to L2/L3 security teams. Create, update, and maintain security incident tickets and investigation reports. Follow established incident response procedures, security policies, and standard operating procedures. Perform basic threat intelligence research and IOC analysis. Collaborate with internal IT and security teams to support incident resolution. Maintain accurate documentation of security events and investigation findings. Technical Skills Required Networking Fundamentals TCP/IP, DNS, DHCP, HTTP, HTTPS, and VPN. Basic understanding of network ports and protocols. Knowledge of firewalls, IDS, and IPS. Security Fundamentals Understanding of malware, ransomware, phishing, and social engineering. Knowledge of vulnerabilities, threats, and security risks. Understanding of authentication and access control. Basic knowledge of incident response processes. SIEM Tools Splunk IBM QRadar Microsoft Sentinel Operating Systems Windows operating system. Linux fundamentals. Windows Event Logs and Linux Syslogs. Security Frameworks MITRE ATT&CK Framework. Cyber Kill Chain. Basic understanding of the CIA Triad. Tools and Technologies SIEM: Splunk, IBM QRadar, Microsoft Sentinel. EDR: CrowdStrike Falcon, Microsoft Defender for Endpoint. Network Analysis: Wireshark. Threat Intelligence: VirusTotal, AbuseIPDB. Ticketing Tools: ServiceNow, Jira. Security Technologies: Firewall, IDS, IPS, Antivirus.

What you’ll do

Monitor and analyze security alerts, logs, and endpoint activity to identify, investigate, classify, and prioritize potential threats and incidents. Document investigations, maintain incident tickets and reports, follow response procedures, and escalate critical incidents while collaborating with IT and security teams.

Requirements

The role requires foundational knowledge of networking, security threats, access control, incident response, Windows and Linux logs, and security frameworks such as MITRE ATT&CK and the Cyber Kill Chain. Familiarity with SIEM, EDR, network analysis, threat intelligence, and ticketing tools is expected.

Listed skills

• Windows · Preferred
• Linux · Preferred

Other relevant skills

Identified from the job description. Confirm important requirements above.

• Security Event Monitoring
• SIEM
• Security Log Analysis
• Incident Triage
• Incident Response
• Threat Analysis
• Phishing Investigation
• Malware Analysis
• EDR
• Threat Intelligence
• Network Fundamentals
• Firewalls
• IDS/IPS
• Windows
• Linux
• MITRE ATT&CK

Job areas

• Security & Safety
• Technology
• Software

More jobs from Spait Infotech