Security Operations Center Analyst

1–3+ years of experience in a SOC, incident response, or security operations environment.

Hands-on experience with SIEM, EDR, and cloud security tools (e.g., Microsoft Sentinel, Defender XDR, Splunk, CrowdStrike, etc.).

Strong understanding of Windows, Linux, and/or macOS internals; identity security; authentication flows; and network fundamentals (TCP/IP, DNS, HTTP).

Familiarity with threat landscape, threat intelligence workflows, and MITRE ATT&CK.

Ability to write basic queries or scripts (KQL, SPL, PowerShell, Python, etc.).

Analytical thinker with strong troubleshooting skills and a structured approach to incident handling.

Monitor SIEM, EDR, IDS/IPS, cloud security, and email security alerts for potential threats or abnormal activity.

Triage, validate, and investigate security alerts; identify false positives; escalate or resolve incidents as appropriate.

Perform in-depth analysis of suspicious activity and correlate logs across multiple systems to determine root cause, scope, and impact.

Execute containment and remediation actions such as host isolation, account lockdown, IOC blocking, vulnerability mitigation, and post-recovery validation.

Conduct proactive threat hunting based on threat intelligence, behavioral patterns, or hypothesis-driven analysis.

Support forensic data collection and examination (endpoint artifacts, system logs, cloud audit logs, etc.).