SOC Analyst

Position summary

Monitoring and case handling

• Continuously monitor alerts, classify type and potential severity, and determine whether to escalate or close as false positive.
• Follow playbooks and runbooks, escalate alerts beyond L1 scope, and document decisions and findings.
• Maintain complete case notes and communicate open items during shift handoffs.
• Use GreyMatter for alert review, case management, enrichment, and initial investigation; validate AI-assisted outputs.
• Review Defender for Endpoint alerts and device timelines, process trees, and artifacts for escalation.
• Review Sentinel incidents and use provided KQL templates to gather log evidence.
• Review Zscaler and Netskope web security alerts and gather context for L2 investigations.
• Manage ServiceNow SOC tickets, including routine suspicious-email reports, access queries, and basic tool questions.
• Triage suspicious emails using Mimecast and/or Abnormal.ai; assess senders, links, attachments, and headers.
• Support quarantine and release workflows under L2 direction; flag repeat patterns for knowledge articles.

Required skills and experience

• At least 1 year in a SOC, IT operations, helpdesk, or security monitoring role.
• Basic networking knowledge: TCP/IP, DNS, HTTP/S, common ports, and protocols.
• Familiarity with Windows processes, services, event logs, and common file system paths.
• Awareness of phishing, malware, credential abuse, and suspicious scripting.
• Ability to follow structured procedures, playbooks, and escalation paths precisely.
• ServiceNow or equivalent ITSM experience, including ticket creation, classification, and documentation.
• Strong attention to detail and clear written communication for case notes and shift handoffs.
• Bachelor's degree in Computer Science, Information Security, Engineering, or equivalent practical experience.

Preferred qualifications and certifications

• Prior SIEM exposure, such as Microsoft Sentinel, Splunk, or similar, is preferred.
• Microsoft Defender for Endpoint or equivalent EDR familiarity is preferred.
• Phishing analysis and email security tool exposure is preferred.
• Foundational understanding of MITRE ATT&CK is preferred.
• CompTIA Security+ is preferred or actively pursued; Microsoft SC-900 is a plus; CompTIA CySA+ or equivalent is desirable.

Working conditions

• The role works 24×7 rotational shifts, including nights, weekends, and holidays.
• On-call support may be required for high-severity incidents.
• The work requires sustained alertness, consistent process adherence, and composed, methodical work under pressure.

Success measures