Description:

• Monitor alerts from SIEM, firewalls, IDS/IPS, endpoint tools, and other security systems to identify potential incidents.
• Triage security alerts by severity, impact, and urgency using established criteria.
• Collect and validate initial alert details such as source, target, timestamp, and related logs.
• Perform preliminary analysis using playbooks and SOPs to identify false positives or determine whether escalation is needed.
• Execute containment actions from playbooks, such as blocking IP addresses or isolating affected systems.
• Verify remediation steps are effective and document all actions with timestamps.
• Escalate complex, advanced, or high-priority incidents to Level 2 analysts with detailed context and analysis.
• Maintain accurate SOC incident records, including alerts, outcomes, and audit-ready documentation.
• Communicate status updates, key findings, risks, and required actions to supervisors and response teams.
• Collaborate with teammates to resolve blockers and support incident response workflows.

Requirements:

• Familiarity with SIEM platforms such as Elastic, Splunk, or QRadar, as well as firewalls, IDS/IPS, and endpoint tools.
• Basic knowledge of networking concepts including TCP/IP, DNS, VPN, HTTP, and FTP.
• Awareness of common threats and attack vectors, including phishing, malware, and DDoS.
• Ability to triage alerts and distinguish false positives from real threats.
• Experience following playbooks and SOPs for initial response and remediation.
• Strong attention to detail for monitoring events, identifying anomalies, and documenting actions.
• Clear written and verbal communication skills for reporting findings and escalating incidents.
• Ability to collaborate effectively in team-based incident response situations.
• Comfort working in a high-pressure, dynamic environment with multiple concurrent tasks.
• Willingness to work 24/7 shifts, including nights and weekends; shift schedule includes 7 a.m. - 7 p.m. Mon-Tues-Wed and 7 a.m. - 7 p.m. Sun-Mon-Tues every third or fourth week.
• Degree in cybersecurity, IT, or a related field preferred, or equivalent experience.
• Entry-level certifications such as CompTIA Security+ or Cisco CCNA preferred, or equivalent experience.
• Additional security certifications are desired.