Soc Analyst

SOC Analyst

Job Description:

We are seeking a skilled and proactive Senior SOC Operations Analyst to join our cybersecurity operations team. The ideal candidate will bring in-depth experience in working with SIEM, XDR tools, incident response processes, and phishing analysis. This role will be responsible for monitoring, detecting, analyzing, and responding to cybersecurity incidents, with a focus on threat detection, automation, and continuous improvement of SOC operations.

1. SIEM Operations and Monitoring

• Monitor, investigate, and analyze logs and alerts generated by SIEM tools such as Microsoft Sentinel, Splunk, and LogRhythm.
• Perform log correlation and filtering to identify malicious patterns and reduce false positives.
• Understand and modify existing correlation rules and develop use cases to detect anomalies and security events.
• Analyze various log sources including Windows Event Logs, Firewall, Proxy, VPN, DNS, and other security infrastructure logs.

2. XDR Investigation and Threat Hunting

• Utilize Extended Detection and Response (XDR) platforms such as Trend Micro Vision One, CrowdStrike Falcon, and Microsoft Defender for Endpoint.
• Conduct endpoint investigations, analyze process behavior, service activity, and network connections.
• Block known Indicators of Compromise (IOCs), investigate suspicious behavior, and recommend containment actions.
• Monitor for lateral movement, persistence techniques, and privilege escalations.

3. Incident Response and Escalation

• Triage alerts by categorizing and prioritizing incidents (malware, unauthorized access, data leakage, etc.).
• Respond to security incidents and determine scope, impact, severity, and root cause.
• Document incident findings and escalate to appropriate stakeholders per defined processes and SLAs.
• Collaborate with other IT and security teams for containment, eradication, and recovery.

4. Phishing and Email Threat Analysis

• Analyze suspected phishing/spam emails including header analysis, embedded links, attachments, and URLs.
• Perform domain/IP reputation checks using threat intelligence platforms.
• Work closely with email administrators and security teams to block malicious senders and educate users.

5. Security Analysis and Threat Validation

• Use open-source tools and threat intelligence feeds to validate IOCs and assess their impact.
• Identify vulnerabilities and suspicious behavior related to malware, fileless attacks, or command execution.
• Maintain awareness of evolving threat actor techniques and indicators.

6. Scripting and Automation Awareness

• Detect and review suspicious scripts for embedded commands, credential theft, and persistence mechanisms.
• Identify common scripting languages used in attacks (PowerShell, Bash, Python).
• Contribute to playbook development and automation initiatives within the SOC.

7. Networking and Security Fundamentals

• Understand IP addressing, port protocols (TCP/UDP), DNS, HTTP/HTTPS, and VPN tunnels.
• Differentiate between internal and external traffic and identify unusual network behavior.
• Correlate network-based alerts with endpoint and application data for full-context analysis.

Tools & Technologies:

• SIEM: Forescout, Splunk
• XDR/EDR: Trend Vision One, CrowdStrike
• Email Security: TrendMicro Email Gateway, KnowBe4
• Scripting: PowerShell, Python (basic code understanding)
• Open-Source: VirusTotal, URLscan, AbuseIPDB, Shodan, Hybrid Analysis
• Ticketing: ServiceNow
• Threat Intelligence: MISP, AlienVault OTX, IBM X-Force Exchange