Security Operations Center Analyst

Role Overview

Seeking a skilled and motivated L1/L2 Analyst – Dark Web Monitoring & Threat Intelligence to join our Security Operations Center (SOC) team.

In this role, the analyst will focus on dark web intelligence gathering, analysis, and reporting, leveraging platforms such as CloudSEK to identify potential threats, data leaks, credential exposures, and emerging risks to the customer’s environment. The candidate will also support the wider SOC with actionable threat intelligence to strengthen detection, response, and proactive defense capabilities.

Key Responsibilities

Dark Web Monitoring & Analysis

• Continuously monitor dark web, deep web, and surface web sources using CloudSEK and other threat intelligence tools for indicators of compromise (IOCs), credential dumps, leaked data, and potential threats targeting the customer.
• Identify and analyze mentions of the customer’s brand, infrastructure, domains, or key personnel on illicit marketplaces, forums, and communication channels.
• Perform correlation and enrichment of dark web data with internal telemetry and external threat feeds to derive actionable intelligence.
• Escalate high-severity findings to the SOC Incident Response team with clear analysis and recommendations.

Threat Intelligence Operations

• Support the development and delivery of threat intelligence reports, alerts, and advisories tailored to the customer’s business context and threat landscape.
• Track and profile threat actors, campaigns, and TTPs relevant to the customer’s industry sector.
• Contribute to the creation and tuning of detection use cases in SIEM/EDR platforms based on emerging threat intelligence.
• Assist in integrating threat intelligence feeds into the SOC ecosystem and automating enrichment workflows where applicable.
• Participate in threat hunting exercises and collaborate with detection engineering teams to enhance visibility and defense posture.

Collaboration & Knowledge Sharing

• Work closely with SOC L2/L3 analysts, incident responders, and platform engineering teams to improve detection and response capabilities.
• Document findings, workflows, and intelligence processes in knowledge bases and SOPs.
• Contribute to customer-facing threat briefings and periodic intelligence summaries

Required Qualifications & Skills

Education & Experience:

• 3 Yrs with BE/BTech/MCA

Technical Skills:

• Strong knowledge of SIEM platforms (e.g., Seceon, QRadar, Arcsight, Elastic) and log analysis.
• Hands-on experience with threat intelligence platforms (TIPs) such as CloudSEK, Anomaly, Recorded Future, or equivalent.
• Proficiency in monitoring and analyzing dark web forums, marketplaces, and communication channels.
• Strong understanding of threat actor TTPs, cybercrime ecosystems, and underground economy dynamics.
• Familiarity with SIEM, EDR, and NDR platforms and their integration with threat intelligence feeds.
• Knowledge of MITRE ATT&CK, cyber kill chain, and threat modeling methodologies.
• Basic scripting (Python, PowerShell) for automation and data enrichment is an advantage.