Cyber Security Analyst

SOC Analyst – Level 1 (L1)

Key Responsibilities

• Monitor security alerts and events generated by the SIEM on a continuous basis.
• Perform initial triage and classification of alerts to determine true positives, false positives, and priority level.
• Escalate confirmed or high-priority incidents to L2/L3 analysts following defined escalation procedures.
• Document all analyzed alerts and actions taken in the case management system (DFIR-IRIS).
• Execute pre-approved response playbooks/workflows via the SOAR platform SOAR under L2 guidance.
• Perform basic enrichment of alerts using threat intelligence data Thread Intel — e.g., checking IP/domain/hash reputation.
• Monitor dashboards for system health, agent connectivity, and log ingestion status.
• Follow standard operating procedures (SOPs) and playbooks for common alert types (malware, brute force, policy violations, etc.).
• Maintain shift handover logs and communicate ongoing issues to the next shift.
• Assist in the creation and refinement of detection rules and reports as directed by senior analysts.

Required Skills & Qualifications

• Bachelor's degree in Computer Science, IT, Cybersecurity, or equivalent experience.
• 0–2 years of experience in a SOC or IT security role.
• Basic understanding of networking concepts (TCP/IP, DNS, HTTP/S, firewalls).
• Familiarity with common attack techniques (phishing, malware, brute force) and the MITRE ATT&CK framework (basic level).
• Basic knowledge of SIEM tools (Wazuh or similar) and log analysis.
• Good verbal and written communication skills for shift handovers and reporting.
• Ability to work rotational shifts, including nights/weekends.

SOC Analyst – Level 2 (L2) Key Responsibilities

• Investigate and analyze incidents escalated by L1 analysts, performing deeper root-cause and impact analysis.
• Solid understanding of networking, operating systems (Windows/Linux), and common attack vectors.
• Lead incident response activities, coordinating containment, eradication, and recovery actions.
• Correlate data across SIEM, threat intelligence, and case management to build a complete picture of an incident.
• Design, build, and refine automated response workflows/playbooks in SOAR to improve response times and reduce manual effort.
• Perform threat hunting activities based on emerging threat intelligence, IOCs, and TTPs (Tactics, Techniques, and Procedures).
• Tune and refine SIEM correlation rules to reduce false positives and improve detection accuracy.
• Manage and update case records in , ensuring thorough documentation of evidence, timeline, and remediation steps.
• Conduct malware analysis (static/basic dynamic) and file/system forensics when required.
• Review and validate vulnerability scan results and SCA (Security Configuration Assessment) findings, prioritizing remediation with system owners.
• Mentor and provide technical guidance to L1 analysts, reviewing their triage decisions and providing feedback.
• Prepare detailed incident reports and executive summaries for management/client review.
• Contribute to the continuous improvement of SOC processes, playbooks, and detection content.
• Liaise with IT/infrastructure teams during incident containment and remediation activities.

Required Skills & Qualifications

• Bachelor's degree in Computer Science, IT, Cybersecurity, or equivalent experience.
• 1–2+ years of experience in a SOC, incident response, or security analyst role.
• Solid understanding of networking, operating systems (Windows/Linux), and common attack vectors.
• Hands-on experience with SIEM platforms (Wazuh preferred), log analysis, and correlation rule tuning.
• Experience with SOAR platforms (Shuffle or similar) for workflow automation.
• Familiarity with threat intelligence platforms (MISP) and applying IOCs/TTPs in investigations.
• Experience with case management/incident response platforms (DFIR-IRIS or similar).
• Strong understanding of the MITRE ATT&CK framework and its application in detection/investigation.