Security Operations Center (SOC) Analyst

Job Title: Security Operations Center (SOC) Analyst

Job Purpose: L1 SOC Analyst – XDR Platform - L1 SOC Analyst to provide 24x7 security monitoring and support for Extended Detection and Response (XDR) platform. This role is the first line of defense in identifying, triaging, and escalating potential security incidents, ensuring threats are addressed quickly and effectively.

Qualification: Graduation

Certification:

• CompTIA CySA+ / Security+ / CEH

• Splunk Core Certified User / Power User

• Microsoft AZ-500 / SC-200

• CrowdStrike Certified Falcon Responder (CFR)

Experience: 5+ Years

Responsibilities:

• Monitor the XDR platform and SIEM dashboards for security alerts and suspicious activities.

• Perform initial triage of alerts to assess severity, scope, and potential impact.

• Escalate confirmed incidents to respective domains/Resolving Teams with detailed findings.

• Investigate events using log analysis, threat intelligence, and platform tools.

• Assist in log source validation and troubleshooting to maintain data accuracy.

• Perform log integration break-fix activities when data feeds are disrupted.

• Follow established SOPs and incident escalation procedures.

• Document all investigations and actions taken in the ticketing system.

• Work collaboratively with senior analysts to improve detection rules and alert accuracy.

Skills & Experience

• Basic to intermediate experience with XDR platforms (e.g., Microsoft Defender XDR, CrowdStrike)

• Familiarity with SOC monitoring, detection, triage, and incident escalation.

• Knowledge of log collection, parsing, and troubleshooting.

• Understanding of common cyber threats and attack techniques.

• Good problem-solving and communication skills.

• Willingness to work in rotational shifts (including nights/weekends).

• Preferred certifications: CompTIA Security+, Microsoft SC-200, CEH, or similar.

Mandatory:

• 3-5 years of relevant experience in a SOC environment.

• Strong hands-on knowledge of SIEM (Splunk) and EDR (CrowdStrike).

• Experience in log analysis, threat detection, and incident handling.

• Good understanding of TCP/IP, DNS, HTTP, VPN, authentication, cloud security basics.

• Familiarity with ISO 27001, or NIST 800-61 IR process is a plus.

• Certifications such as CompTIA CySA+, CEH, Splunk Core/User, or AZ-500 preferred.

• Bachelor’s degree in computer science, Information Technology, or related field.

• At least 5 years of experience in support operations

• Strong analytical mindset and attention to detail.

• Ability to prioritize under pressure and respond within SLA timelines.

• Proactive, accountable, and a team player.

• Willingness to work in shifts (24x7 SOC coverage) if required.

‍

‍