Splunk - SOC

Hi,

Yusuf

Role Overview

Monitoring & Analysis

• Monitor security alerts from Splunk SIEM tool.
• Perform deep-dive analysis on escalated alerts from L1 analysts
• Identify false positives vs. real security incidents
• Correlate logs from multiple sources (firewalls, endpoints, proxy, email, IDS/IPS etc.)

Incident Response

• Investigate and respond to security incidents (malware, phishing, insider threats, etc.)
• Conduct root cause analysis and impact assessment
• Execute containment, eradication, and recovery actions
• Document incidents and maintain case records

SOAR Responsibilities

• Use SOAR platforms (e.g., Fortinet SOAR)
• Develop, modify, and optimize playbooks/runbooks
• Automate repetitive tasks (alert triage, enrichment, ticket creation)
• Perform automated response actions (block IPs, disable users, isolate endpoints etc..)

Threat Intelligence & Hunting

• Analyze threat intelligence feeds and indicators of compromise (IOCs)
• Perform proactive threat hunting using logs and behavioural analysis
• Stay updated on latest threats, vulnerabilities, and attack techniques (MITRE ATT&CK)

Reporting & Documentation

• Create incident reports and dashboards
• Provide recommendations to improve detection and response
• Maintain SOPs, playbooks, and knowledge base

Collaboration

• Work with L1 analysts for guidance and escalation handling
• Coordinate with IT, network, and security teams
• Support compliance and audit requirements

Technical Skills

Operating systems (Windows, Linux)

Soft Skills

Qualifications

Preferred Certifications

• CompTIA Security+

• Giac (Gcia, Gcih)

• SOAR platform certifications (if available)

Bonus Skills

• Threat hunting experience
• Malware analysis basics
• Cloud security (AWS, Azure)

• Scripting (Python, PowerShell