Key Responsibilities

Monitoring & Detection

• 
  
• Monitor security alerts and events from multiple sources (SIEM, EDR, firewalls, IDS/IPS, email security tools, etc.)
  
• Identify potential security incidents through alert analysis and correlation
  
• Perform initial triage to determine severity and impact
  

Incident Triage & Response

• 
  
• Investigate alerts to distinguish between true positives and false positives
  
• Follow predefined playbooks and runbooks for incident response
  
• Escalate confirmed or suspicious incidents to SOC L2/L3 teams
  
• Document all findings, actions, and decisions in the ticketing system
  

Threat Analysis Support

• 
  
• Perform basic threat intelligence checks (IP reputation, domain analysis, file hashes)
  
• Enrich alerts with contextual information
  
• Assist in identifying patterns or recurring security issues
  

Operational Tasks

• 
  
• Maintain and update incident tickets accurately
  
• Participate in shift handovers and report key incidents
  
• Ensure SLAs for alert handling and escalation are met
  
• Support continuous improvement by providing feedback on detection rules
  

Required Skills & Qualifications

Technical Skills

• 
  
• Basic understanding of:
  
  • 
    
  • Networking (TCP/IP, DNS, HTTP/S)
    
  • Operating systems (Windows, Linux basics)
    
  • Cybersecurity concepts (malware, phishing, brute force, lateral movement)
    
  
  
• Familiarity with:
  
  • 
    
  • SIEM tools (e.g., Microsoft Sentinel, GoogleSecOps, Elastic, Splunk, QRadar)
    
  • Endpoint security solutions (e.g., Defender for Endpoint)
    
  • Log analysis
    
  
  

Analytical Skills

• 
  
• Strong attention to detail and investigative mindset
  
• Ability to follow structured processes and playbooks
  
• Good decision-making under pressure
  

Soft Skills

• 
  
• Strong written and verbal communication
  
• Ability to work in shifts (including nights/weekends if applicable)
  
• Team player with a proactive attitude
  

 
Preferred Qualifications

• 
  
• 0–2 years of experience in cybersecurity or IT operations
  
• Relevant certifications (nice to have):
  
  • 
    
  • CompTIA Security+
    
  • SC-200 (Microsoft Security Operations Analyst)
    
  • CEH (Certified Ethical Hacker) – basic level
    
  
  

• 
  
• Exposure to:
  
  • 
    
  • SIEM platforms (especially Microsoft Sentinel if in M365 environment)
    
  • Incident response processes
    
  • Threat intelligence tools
    
  
  

Key Metrics / KPIs

• 
  
• Alert triage time
  
• Incident escalation quality
  
• SLA adherence
  
• False positive vs. true positive accuracy
  
• Documentation completeness
  

 
Working Conditions

• 
  
• 24/7 SOC environment (shift-based work required)
  
• High-pressure, fast-paced incident response scenarios
  
• Collaboration with global SOC teams and stakeholders