Level 1 SOC Analyst

THE ROLE:  Security Operations Analyst (Tier 1)

Job Summary:

The Security Operations Centre (SOC) Analyst assists in analysing P1/P2/P3 alerts triggered by the SOC monitoring tools and to participate in the maintenance and tuning of these tools.  The SOC analyst will function as a Tier 1 analyst, and act as the entry point for security incidents triage and analysis and customer requests. The Tier 1 SOC analyst will review security incident as per internal processes and escalate to the Tier 2 analyst as required. He will work with other analysts to collect, correlate, and analyse security-relevant data, and respond to threats in a timely manner.

Job Responsibilities:

• Work with the other Tier 1 SOC Analysts, to perform analysis and triage of security incidents and threat activity
• Provide support and cooperate with other members of the SOC team
• Be responsible to manage his time and the assigned tasks
• Regularly and promptly carry out the ticket management tasks
• Monitor the security ticket dashboard to make sure that customer SLA are not breached
• Staying up to date with emerging security threats
• Communicate effectively with customers, teammates, and management
• Monitoring and management of SIEM infrastructure
• Monitor the service ticket board and ensure the tickets are managed and responded in line with SLA
• Escalate false positive incidents to L2 Analyst for fine tuning
• Provide feedback to help automating common recurring tasks
• Create monthly customer reports
• Review vulnerability scans results

Required Skills:  

• Requires background in at least 2 of the following domains: ethical hacking, incident response, forensic analysis, security engineering, incident analysis and investigations
• At least 1 years’ experience in managing working in Security Operations Centre with a Security Incident & Event Management (SIEM)
• Experience on SIEM technology, preferably on Microsoft Sentinel
• Experience in incident analysis, detection and response
• Knowledge of network and server security products, technologies, and protocols
• Knowledge of security devices such as Firewall, IPS/IDS, Web proxy
• Good OS knowledge such as Windows and Linux
• Security certifications (CompTIA Security+, CEH, Microsoft SC-200) preferred