SOC Analyst

SOC Analyst L1.5 / SOC Analyst L2 Mumbai · Full Time · Hybrid

---

About the Role The SOC Analyst roles involve monitoring, identifying, triaging, and responding to security alerts and incidents within the Security Operations Center (SOC). The positions require continuous monitoring of security tools, initial investigation of alerts, incident documentation, escalation of complex incidents, and adherence to established security processes and procedures. Success in these roles depends on the ability to analyze security events, gather supporting evidence, and escalate incidents as required.

---

Key Responsibilities

• Monitor and analyze alerts generated from SIEM, EDR/XDR, Email Security, WAF, Proxy, and other security solutions.
• Perform first-level triage and classification of security alerts and incidents.
• Investigate security events and gather supporting evidence from multiple log sources.
• Escalate confirmed or suspected incidents to L2/L3 teams as required.
• Identify and analyze phishing emails, malicious URLs, suspicious attachments, and email threats.
• Monitor malware, ransomware, brute-force attempts, and endpoint security alerts.
• Perform basic log analysis across Windows, Linux, firewall, application, proxy, and endpoint logs.
• Validate Indicators of Compromise (IOCs) and document findings.
• Follow incident response playbooks and runbooks.
• Coordinate with internal teams to support investigations.
• Prepare incident reports and maintain case documentation.
• Participate in shift handovers and daily operational reporting.
• Ensure compliance with SOC monitoring SLAs.
• Investigate escalated incidents from L1 with detailed root cause analysis.
• Perform advanced log correlation across multiple security platforms.
• Support incident response activities including containment, eradication, and recovery.
• Conduct phishing email investigations including header analysis, URL reputation checks, and payload and attachment analysis.
• Analyze malware behavior using static and basic dynamic analysis.
• Extract and validate IOCs.
• Conduct proactive threat hunting exercises.
• Investigate DDoS alerts and network-based attacks.
• Monitor endpoint and network security events.
• Assist in SIEM rule tuning and use case optimization.
• Perform EDR/XDR investigations and endpoint containment actions.
• Update incident response playbooks and operational SOPs.
• Coordinate with infrastructure, network, and application teams.
• Prepare incident reports and RCA documentation.
• Support and mentor junior SOC analysts.

---

Requirements

• Manage SIEM tools such as QRadar, Splunk, or Microsoft Sentinel.
• Utilize Endpoint Security tools like EDR/XDR and Antivirus Solutions.
• Operate WAF tools such as Imperva or Equivalent.
• Employ Proxy Security tools like Symantec Proxy, Forcepoint.
• Use Email Security tools such as Symantec Email Security, Trellix EX, Microsoft Defender for O365.
• Apply Incident Management skills including Alert Monitoring, Triage & Escalation.
• Leverage Threat Intelligence skills including IOC Validation, MITRE ATT&CK Basics.
• Perform Log Analysis across Windows, Linux, Firewall, Proxy, EDR Logs.
• Understand Network Security concepts including TCP/IP, DNS, HTTP, HTTPS.
• Apply Security Fundamentals including Cyber Security Concepts, Attack Lifecycle.
• Have 2–6 years of SOC Monitoring and Security Operations experience.
• Possess hands-on experience with SIEM tools.
• Have knowledge of phishing analysis, malware investigation, and incident handling.
• Understand networking protocols and security concepts.
• Demonstrate strong analytical and troubleshooting skills.
• Exhibit excellent communication and documentation abilities.
• Be willing to work in a 24×7 rotational shift environment.

---

What We Offer No information available.