About this role
Role Summary
The SOC Analyst (L1) is responsible for monitoring, detecting, triaging, and escalating security events generated from enterprise security tools. The role provides hands-on exposure to security operations, incident investigation, threat monitoring, phishing analysis, and cybersecurity defense activities in a 24x7 Security Operations Center environment.
Key Responsibilities
Security Monitoring & Alert Management
- Hands-on experience with Crowdstrike NG-SIEM, Proofpoint and CrowdStrike Query Language (CQL)
- Monitor security alerts generated from SIEM, EDR, Email Security, and Network Security platforms.
- Perform initial triage and analysis of security events.
- Identify false positives and escalate genuine security incidents.
- Follow SOC runbooks and standard operating procedures.
Incident Handling
- Investigate suspicious activities, malware alerts, phishing attempts, and account compromise events.
- Document findings, actions taken, and incident details.
- Assist senior analysts during incident response activities.
Threat Analysis
- Review indicators of compromise (IOCs).
- Correlate security events from multiple data sources.
- Support threat intelligence enrichment activities.
Reporting & Documentation
- Maintain accurate shift handover notes.
- Update incident tickets within SLA requirements.
- Create investigation summaries and operational reports.
Required Skills
- Hands-on experience with CrowdStrike NG-SIEM, Proofpoint, and CrowdStrike Query Language (CQL)
- Knowledge of Networking fundamentals (TCP/IP, DNS, HTTP, HTTPS).
- Understanding of Windows and Linux operating systems.
- Familiarity with security concepts such as malware, phishing, ransomware, and vulnerabilities.
- Good analytical and problem-solving skills.
- Strong written and verbal communication skills.
Educational Qualification
- B.Tech / BE / BCA / MCA / BSc (Computer Science, IT, Cybersecurity)
- Cybersecurity certifications preferred:
Security+
- SC-900
Key Success Metrics
- Alert triage accuracy
- SLA adherence
- Incident documentation quality
- Continuous learning and certification progress