SOC Analyst L1

Job Description

Title: SOC Analyst – L1

Location: Pune

Experience: 1–2Years

Employment Type: Full-Time

Shift: Rotational Shifts, including Night Shifts

About The Role

We are looking for a SOC Analyst – L1 to join our Security Operations Center team. The ideal candidate should have hands-on experience working with Microsoft Sentinel, be comfortable writing KQL queries, and have prior experience in an MSSP/SOC environment.

The candidate will be responsible for continuous security monitoring, initial alert investigation, incident triage, escalation, and supporting the incident response team.

Key Responsibilities

• Monitor security alerts and events using Microsoft Sentinel and other security monitoring tools.
• Perform L1 alert triage and investigate suspicious activities.
• Analyze logs from endpoints, firewalls, network devices, cloud environments, identity systems, and other security sources.
• Write and execute KQL (Kusto Query Language) queries for alert investigation, threat hunting, and log analysis.
• Perform initial investigation of security incidents and determine severity, impact, and priority.
• Identify false positives and perform appropriate alert closure with proper documentation.
• Escalate confirmed or complex incidents to L2/L3 / Incident Response teams.
• Have a basic understanding of Incident Response (IR) processes, including identification, containment, eradication, and recovery.
• Follow SOC playbooks, escalation procedures, and incident-handling processes.
• Maintain accurate investigation notes and incident documentation.
• Work with multiple customer environments in an MSSP setup while maintaining SLA requirements.
• Participate in continuous improvement of detection rules, use cases, and SOC processes.
• Stay updated on common attack techniques, vulnerabilities, and threat intelligence.
  
  

Mandatory Skills & Experience

• 1–3 years of experience in SOC / Cybersecurity Operations.
• Hands-on experience with Microsoft Sentinel is mandatory.
• Good understanding of KQL and ability to write queries for security investigations.
• Previous experience working in an MSSP / Managed SOC environment is mandatory.
• Experience handling and triaging security alerts/incidents.
• Basic understanding of Incident Response and SOC processes.
• Basic understanding of SIEM concepts and log analysis.
• Understanding of common security threats such as phishing, malware, brute-force attacks, credential attacks, suspicious PowerShell activity, and unauthorized access.
• Ability to analyze security events and correlate information from multiple log sources.
• Willingness to work in rotational shifts, including night shifts, weekends, and public holidays.
• Good communication and incident documentation skills.
  
  

Good to Have

• Experience with Microsoft Defender XDR / Defender for Endpoint / Defender for Identity.
• Knowledge of Azure and Microsoft Entra ID security.
• Experience with EDR/XDR platforms.
• Basic knowledge of network security, firewalls, IDS/IPS, VPN, DNS, and authentication protocols.
• Knowledge of MITRE ATT&CK framework.
• Experience creating or tuning Sentinel analytics rules and detection use cases.
• Relevant certifications such as SC-200, Security+, CEH, or equivalent.
  
  

Candidate Profile

• We are looking for someone who:
• Can independently perform L1 alert triage.
• Is comfortable working with Microsoft Sentinel and KQL daily.
• Understands how an MSSP/SOC operates across multiple customers.
• Can differentiate between false positives and genuine security incidents.
• Has a security-first mindset and strong analytical skills.
• Is comfortable working under SLA-driven and shift-based SOC operations.
• Is willing to learn and progress toward an L2 SOC / Incident Response role.
  
  

Important Requirement

Candidates without hands-on Microsoft Sentinel and KQL experience, or without prior MSSP/SOC experience, may not be considered.