Security Operations

• The SOC Analyst is responsible for maintaining the organization’s cybersecurity posture through continuous monitoring, detection, and incident response.
• Using advanced technologies such as Endpoint Detection and Response (EDR), Security Information and Event Management (SIEM), Network Detection and Response (NDR), File Integrity Monitoring (FIM), and Next-Gen Antivirus (NGAV), the analyst identifies and mitigates security threats in real time.
• This role also contributes to the design and development of automated playbooks using Security Orchestration, Automation, and Response (SOAR) platforms to streamline response workflows and improve SOC efficiency.
• The analyst collaborates across teams to strengthen detection logic, enhance processes, and ensure proactive defense against evolving cyber threats.
• Threat Monitoring & Detection
• Monitor and analyze security alerts from SIEM, EDR, NDR, FIM, and Antivirus platforms to detect potential threats.
• Perform correlation and pattern analysis across multiple data sources to identify anomalies and sophisticated attack behaviors.
• Continuously tune and optimize detection rules to reduce false positives and improve fidelity.
• Incident Response & Management
• Execute incident response lifecycle activities including triage, containment, eradication, and recovery following NIST standards.
• Document incidents thoroughly, providing root cause analysis, attack vectors, and corrective actions.
• Support post-incident reviews to identify control gaps and recommend security improvements.
• Playbook Development & Automation
• Develop, maintain, and enhance incident response playbooks and runbooks to ensure standardized handling of recurring alerts and use cases.
• Collaborate with senior analysts to build SOAR playbooks for automated enrichment, containment, and notification workflows.
• Align playbooks with MITRE ATT&CK and Cyber Kill Chain frameworks to ensure comprehensive coverage of adversarial tactics.
• Vulnerability & Risk Management
• Conduct regular vulnerability assessments and coordinate with IT teams for timely remediation.
• Evaluate system configurations and network architecture for potential risks and ensure secure baselines.
• Track and report on vulnerability remediation metrics.
• Security Tooling & Integration
• Manage and optimize EDR, SIEM, SOAR, FIM, NDR, and Antivirus tools to ensure operational readiness.
• Integrate data sources and automate workflows between platforms for improved incident visibility and response time.
• Provide input on the design and deployment of new security solutions.
• File Integrity & Endpoint Protection
• Monitor File Integrity Monitoring (FIM) systems to detect unauthorized modifications in critical files and directories.
• Analyze and respond to Antivirus/NGAV alerts to prevent and contain endpoint infections.
• Validate cleanup and verify systems post-remediation.
• Network Detection & Threat Intelligence
• Leverage NDR tools to identify lateral movement, command-and-control (C2) traffic, and exfiltration attempts.
• Incorporate Threat Intelligence Feeds (STIX/TAXII) for enhanced situational awareness and detection context.
• Conduct proactive threat hunting based on known TTPs (Tactics, Techniques, and Procedures).
• Reporting & Compliance
• Generate detailed reports and dashboards highlighting incident metrics, trends, and SOC performance (MTTD, MTTR, volume by category).
• Ensure compliance with standards like ISO 27001, SOC 2, GDPR, HIPAA, and NIST CSF.
• Support audits and assist in evidence gathering for compliance activities.

SOC Analyst

SOC Analyst

Senior SOC Analyst

Security Operations Engineer II

Security Operations – Network Security Analyst, Fortinet, L3 Support