Job Title: SOC L1 Analyst

Job Summary:

We are seeking a vigilant and analytical SOC L1 Analyst to join our Security Operations Center (SOC) as a first responder to cyber threats. In this essential role, you will be on the front lines of our cyber defense, responsible for the 24x7 monitoring of security alerts generated by our suite of advanced detection systems. Your primary mission will be to perform initial analysis and triage on a high volume of events, accurately identify potential threats, weed out false positives, and escalate credible incidents to our L2 Incident Response team. The ideal candidate has a passion for cybersecurity, a strong attention to detail, and the ability to work methodically under pressure, following established playbooks to protect our organization.

Responsibilities

● Continuously monitor security alert queues from a variety of detection systems, including Security Information and Event Management (SIEM), Endpoint Detection and Response (EDR), Network Detection and Response (NDR), and Intrusion Detection/Prevention Systems (IDS/IPS).

● Perform initial triage and assessment of security alerts to determine their criticality and potential impact, distinguishing between real threats and false positives.

● Enrich alerts with contextual data from various sources to support the investigation process.

● Follow documented Standard Operating Procedures (SOPs) and response playbooks for common security scenarios and alert types.

● Create detailed incident tickets for all suspicious activities, meticulously documenting initial findings, actions taken, and analysis performed.

● Escalate verified security incidents and legitimate threats to SOC L2 Analysts in a timely manner, providing a clear and concise summary of the event.

● Handle rest-level response for security events, which may include basic containment actions as defined by playbooks.

● Stay current with emerging cyber threats, vulnerabilities, and attack methodologies to improve detection capabilities.

Requirements

● 1-2 years of experience in a Security Operations Center (SOC), cybersecurity, or a related IT role. An Associate's or Bachelor's degree in Cybersecurity, Computer Science, or a related eld is preferred.

● Hands-on experience with security tools, particularly SIEM platforms (e.g., Splunk, QRadar, LogRhythm) for event investigation.

● A foundational understanding of networking concepts (TCP/IP, DNS, HTTP), operating systems (Windows, Linux), and core security principles.

● Familiarity with common types of cyberattacks and the Cyber Kill Chain or MITRE ATT&CK framework.

● Strong analytical skills with an exceptional attention to detail and the ability to connect disparate pieces of information.

● Excellent written and verbal communication skills, especially in documenting technical findings clearly and concisely.

● Ability to work effectively in a high-pressure, 24x7 shift-based environment.

● Relevant entry-level certifications such as CompTIA Security+, CompTIA CySA+, or GIAC Security Essentials (GSEC) are highly desirable.