Additional Requirements
Qualifications
• Bachelor’s degree in CSE, EEE, ECE, Information Security, or a related field.
• Certifications such as CEH, CCNA, Security+, CySA+, or vendor-specific SIEM/EDR certifications will be an advantage.
Experience
• 1–2 years of relevant experience in SOC or Cybersecurity Operations. Freshers are also encouraged to apply.
Other Skills
• Basic knowledge of networking, Windows/Linux operating systems, and log analysis.
• Familiarity with SIEM, SOAR, EDR, PAM, firewall, and WAF tools.
• Understanding of common cybersecurity threats, including phishing, malware, brute-force attempts, unauthorized access, and indicators of compromise.
• Strong analytical and problem-solving skills, with attention to detail in identifying and investigating security alerts.
• Effective communication and reporting skills, with the ability to coordinate with relevant technical teams.
• Ability to work under pressure and willingness to work in a 24/7 roster-based shift arrangement.
Responsibilities & Context
• Monitor security alerts, events, logs, and dashboards using security monitoring tools, including SIEM, SOAR, EDR, PAM, and DAM.
• Perform initial triage and investigation of alerts and offenses to identify suspicious activities, potential threats, and security incidents.
• Investigate common threat scenarios, including phishing, malware, unauthorized access, brute-force attempts, and suspicious IP addresses, domains, URLs, and file hashes.
• Analyze suspicious emails reported by users, take appropriate action against malicious messages, and provide basic security guidance to reporting users.
• Identify false positives and contribute to the tuning and improvement of monitoring rules, alerts, and security use cases.
• Escalate confirmed or high-risk security incidents to L2 and relevant operations or functional teams in accordance with approved escalation procedures, tracking incidents through closure within defined SLAs.
• Coordinate with Network, Infrastructure, Application, and other relevant teams to investigate security incidents and support timely resolution.
• Maintain complete and accurate records of security alerts, offenses, incidents, and closure activities.
• Prepare daily, shift-wise, and monthly security monitoring and incident handling reports for relevant stakeholders.
• Follow SOC standard operating procedures, security playbooks, information security policies, and applicable regulatory requirements.