Critical Software

Security Operations

• Monitor security alerts and events from EDR, identity protection, cloud security platforms, and other security tools
• Perform initial triage, enrichment, and classification of alerts following SOC playbooks
• Investigate low- to medium-complexity attack patterns, including: Adversary-in-the-Middle (AitM) attacks, suspicious login patterns, endpoint malware detections, privilege misuse indicators, suspicious email or phishing activities
• Correlate events across multiple systems to identify potential malicious behavior
• Use simple scripts (PowerShell, Python, KQL, Bash) for data enrichment, identifying anomalies, and performing small, targeted hunts in specific log sources
• Support senior analysts with observations gained during reconnaissance hunting activities
• Act as the first responder in the incident handling process
• Document findings and escalate incidents to Tier 2/3 analysts or the external SOC with clear, structured communication
• Collaborate with the external SOC provider to validate alerts, coordinate investigations, and ensure accurate incident classification
• Execute containment steps defined in playbooks when authorized
• Serve as an active contributor within the global cybersecurity team, maintaining strong partnerships across IT, operations, and business units
• Communicate technical information clearly to diverse stakeholders, both technical and non-technical
• Participate in daily SOC operational meetings, knowledge sharing, and cross-team collaboration
• Maintain accurate and comprehensive investigation documentation within ticketing and reporting systems
• Suggest improvements to detection rules, use cases, and SOC processes based on observed patterns
• Follow established SOC procedures while contributing to continuous improvement initiatives
• Follow existing SOC playbooks consistently during investigations and incident response workflows
•Contribute to the refinement, enhancement, or creation of Tier 1 playbooks, ensuring they accurately reflect real investigation needs.

SOC Analyst