SOC Analyst

Overview

➢ Monitoring & Analysis

• Monitor security alerts from Splunk SIEM tool.
• Perform deep-dive analysis on escalated alerts from L1 analysts
• Identify false positives vs. real security incidents
• Correlate logs from multiple sources (firewalls, endpoints, proxy, email, IDS/IPS etc.)
• ➢ Incident Response
• Investigate and respond to security incidents (malware, phishing, insider threats, etc.)
• Conduct root cause analysis and impact assessment
• Execute containment, eradication, and recovery actions
• Document incidents and maintain case records
• ➢ SOAR Responsibilities
• Use SOAR platforms (e.g., Fortinet SOAR)
• Develop, modify, and optimize playbooks/runbooks
• Automate repetitive tasks (alert triage, enrichment, ticket creation)
• Perform automated response actions (block IPs, disable users, isolate endpoints etc..)

➢ Threat Intelligence & Hunting

• Analyze threat intelligence feeds and indicators of compromise (IOCs)
• Perform proactive threat hunting using logs and behavioural analysis
• Stay updated on latest threats, vulnerabilities, and attack techniques (MITRE ATT&CK)

➢ Reporting & Documentation

• Create incident reports and dashboards
• Provide recommendations to improve detection and response
• Maintain SOPs, playbooks, and knowledge base
• ➢ Collaboration
• Work with L1 analysts for guidance and escalation handling
• Coordinate with IT, network, and security teams
• Support compliance and audit requirements

Required Skills

• ➢ Technical Skills
• Strong experience with Splunk SIEM tool.
• Hands-on experience with any SOAR platforms.
• Knowledge of:
• o Network security (TCP/IP, DNS, HTTP/S)
• o Operating systems (Windows, Linux)
• o Log analysis and correlation
• Familiarity with:
• o EDR tools (Symantec)
• o NDR tools (Vectra AI)
• o Firewalls, IDS/IPS, Proxy (Bluecoat, Palo Alto, Cisco)
• ➢ Soft Skills
• Strong analytical and problem-solving skills
• Good communication and reporting abilities
• Ability to work in shifts (24/7 SOC environment)
• Attention to detail and quick decision-making
• ➢ Qualifications
• Bachelor’s degree in Cybersecurity / IT / Computer Science (or equivalent)
• 3–5 years of experience in SOC or cybersecurity operations

Preferred Certifications

• CompTIA Security+

• Giac (Gcia, Gcih)

• SOAR platform certifications (if available)