SOC Analyst

Position summary

Alert monitoring and investigation

• Monitor the alert queue, classify alert type and severity, and decide whether to escalate or close false positives.
• Apply playbooks and runbooks and escalate alerts beyond L1 scope or confidence thresholds.
• Use GreyMatter for alert review, case management, enrichment, and initial investigation; validate AI-assisted features.
• Review Defender for Endpoint alerts, device timelines, process trees, and artifacts for escalation.
• Review Sentinel alerts and incidents, use provided KQL templates, and build foundational query proficiency.
• Develop familiarity with Zscaler and Netskope alerts, logs, and policies; gather initial investigation context.

Tickets and email security

• Manage ServiceNow SOC tickets: acknowledge, classify, document, resolve, or escalate within SLA.
• Handle routine security tickets such as suspicious-email reports, access queries, and basic tool questions.
• Triage suspicious emails using Mimecast and/or Abnormal.ai; assess sender, links, attachments, and headers, escalating suspected malicious messages.
• Support quarantine and release workflows under L2 direction and document findings and outcomes.
• Flag recurring patterns and unresolved issues for L2 review and knowledge-article creation.

Required skills and experience

• At least one year in a SOC, IT operations, helpdesk, or security monitoring role.
• Basic knowledge of TCP/IP, DNS, HTTP/S, common ports, and protocols.
• Familiarity with Windows processes, services, event logs, and common file-system paths.
• Awareness of phishing, malware, credential abuse, and suspicious scripting.
• Ability to follow procedures and escalation paths precisely; strong attention to detail and written communication.
• Experience with ServiceNow or equivalent ITSM ticket creation, classification, and documentation.

Preferred qualifications and education

• Prior SIEM exposure, familiarity with EDR, phishing analysis, email security tools, or foundational MITRE ATT&CK knowledge.
• Experience in a 24×7 shift environment is preferred.
• Bachelor's degree in Computer Science, Information Security, Engineering, or equivalent practical experience.
• CompTIA Security+ is preferred or may be in progress; Microsoft SC-900 is a plus; CompTIA CySA+ or equivalent is a desirable development target.

Working conditions

• Work follows 24×7 rotational shifts, including nights, weekends, and holidays.
• On-call support may be required for high-severity incidents.
• The role requires sustained alertness, consistent process adherence, and composed work under pressure.

Success measures