SOC Engineer

Overview

Security Monitoring & Incident Detection

• Monitor security alerts generated from SIEM, XDR, EDR, NDR, IDS/IPS, firewalls, and cloud security platforms.
• Identify, validate, triage, and prioritize security incidents based on severity, impact, and business risk.
• Continuously monitor security events to detect malicious activities and potential threats.

Incident Response & Threat Investigation

• Investigate security incidents and perform root cause analysis.
• Analyze malware, attack techniques, and suspicious activities to determine impact and remediation actions.
• Coordinate containment, eradication, and recovery activities with internal teams.
• Escalate high-severity incidents following established incident response procedures.

Threat Hunting & Detection Engineering

• Perform proactive threat hunting activities using scheduled queries and threat intelligence.
• Monitor threat hunting dashboards and validate suspicious indicators of compromise.
• Identify emerging attack patterns and recommend improvements to detection capabilities.

Vulnerability Management & Security Operations

• Review vulnerability assessment results and monitor remediation progress.
• Validate patch implementation and ensure timely closure of remediation activities.
• Support day-to-day security operations and ensure compliance with operational procedures.

Reporting & Operational Excellence

• Maintain accurate incident records, investigation notes, and ticket updates.
• Prepare daily operational reports, shift handover documentation, and incident summaries.
• Ensure compliance with defined SLAs and operational performance metrics.
• Contribute to continuous improvement of SOC processes and security operations.

Requirements

• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or a related field.
• 1–4 years of hands-on experience working in a Security Operations Center (SOC).
• Experience monitoring SIEM, EDR/XDR, IDS/IPS, firewalls, email security, and cloud security platforms.
• Good understanding of incident triage, security event classification, escalation procedures, and ticket management.
• Strong understanding of networking fundamentals including TCP/IP, DNS, HTTP/HTTPS, VPN, routing, switching, and common network protocols.
• Experience working with Windows and Linux operating systems, endpoint security, and system log analysis.
• Knowledge of common cyber threats including phishing, ransomware, malware, brute force attacks, web attacks, and insider threats.
• Preferred certifications:
• CompTIA Security+
• CompTIA CySA+

• Cisco CyberOps Associate

• Microsoft SC-200
• Additional certifications such as CHFI or DFIR Foundations will be an advantage.

Required Skillset

• Security Information & Event Management (SIEM) monitoring and alert analysis.
• Endpoint Detection & Response (EDR/XDR) and Network Detection & Response (NDR).
• Incident detection, triage, investigation, and response.
• Threat hunting and threat intelligence analysis.
• Vulnerability management and remediation tracking.
• Log analysis across endpoints, servers, firewalls, proxies, Active Directory, cloud platforms, and security appliances.
• Basic scripting skills using PowerShell, Python, or Bash for automation and log analysis.
• Strong documentation, communication, and incident reporting skills.
• Ability to work in a 24×7 SOC environment and collaborate effectively during security incidents.

Benefits

• Competitive Salary + Benefits Package