Title: Senior SOC Analyst / Security Operations Engineer

Role Overview:

Responsible for monitoring, detecting, investigating, and responding to cybersecurity threats across

enterprise IT environments. The role focuses on SIEM operations, security monitoring, incident

investigation, alert triage, and coordination with incident response and infrastructure teams. The

candidate should be capable of independently handling L2 security incidents, performing root-cause

analysis, improving detection use cases, and supporting SOC operational maturity.

Key Responsibilities:

• Monitor security events and alerts using SIEM and security monitoring platforms.
• Perform L1/L2 alert triage and determine the severity and potential impact of security

incidents.

• Investigate suspicious activities, authentication anomalies, malware alerts, and network-

based threats.

• Correlate logs from firewalls, endpoints, servers, identity systems, cloud platforms, and

applications.

• Identify false positives and improve alert tuning to reduce alert fatigue.
• Ensure security alerts are handled within defined SLAs.
• Investigate suspected account compromise, phishing, malware, privilege escalation, and

unauthorized access.

• Conduct initial incident scoping, evidence collection, and containment coordination.
• Collaborate with incident response, network, endpoint, and infrastructure teams.
• Prepare incident timelines, root-cause analysis, and post-incident reports.
• Escalate high-severity incidents according to the incident response process.
• Develop and maintain correlation rules, dashboards, and detection use cases.
• Onboard and validate security log sources.
• Support threat detection using MITRE ATT&CK techniques.
• Perform log analysis and identify gaps in security monitoring coverage.
• Support SIEM health monitoring and troubleshooting.
• Develop SOC playbooks and standard operating procedures.
• Participate in threat hunting and proactive detection activities.
• Support security incident drills and tabletop exercises.
• Contribute to automation and orchestration initiatives.

Tools and Technologies:

Category Tools

SIEM Microsoft Sentinel, Splunk, IBM QRadar

SOAR Microsoft Sentinel automation, Cortex XSOAR, Splunk SOAR

Network Monitoring Wireshark, Zeek, IDS/IPS platforms

Threat Intelligence MISP, VirusTotal, Recorded Future (where licensed)

Endpoint Microsoft Defender for Endpoint, CrowdStrike Falcon

Frameworks MITRE ATT&CK, NIST Incident Response