Security Operations Center Analyst

Job Summary

CSOC Analyst L1 (Tier 1)

1. Security Monitoring & Alert Management

• Continuously monitor security alerts from multiple tools including SIEM, EDR, and monitoring systems
• Track and manage alert queues to identify potential threats

2. Incident Triage

• Perform initial analysis of alerts to determine:
• False positives
• Policy violations
• Intrusion attempts
• Security compromises
• Classify and prioritize security incidents

3. Escalation Handling

• Gather relevant logs, data, and context for incident escalation
• Escalate validated incidents to Tier 2 analysts for deeper investigation
• Ensure proper documentation of all escalated cases

4. Security Tools Monitoring

• Monitor health and performance of:
• Security sensors
• Endpoints
• Detection tools

5. Reporting & Documentation

• Maintain incident logs and reports
• Ensure accurate documentation of alerts, actions taken, and escalation details

Technical Skills Required

• Strong knowledge of:
• **Windows & UNIX/Linux operating systems**
• **TCP/IP (IPv4 & IPv6)**
• Hands-on experience or knowledge in:
• **SIEM tools**

(e.g., Splunk, QRadar, ArcSight)

• **EDR tools**
• **Intrusion Detection & Prevention Systems (IDS/IPS)**
• **Firewalls & Anti-malware solutions**
• **Security orchestration and automated response (SOAR) concepts**

Qualifications

• Bachelor’s degree in Cyber Security, IT, Computer Science, or related field

Required Certifications

• **CompTIA CySA+ (Cybersecurity Analyst Certification)**
• **Incident Response Fundamentals Certification**

Preferred Certifications

• SIEM certifications (Splunk / QRadar / ArcSight)
• Certifications from:

• Sans / Giac

• ISACA
• (ISC)²

Key Competencies

• Strong analytical and problem-solving skills
• Attention to detail
• Ability to work in a 24/7 SOC environment
• Good communication and documentation skills
• Ability to handle high-pressure situations