SOC Analyst (L1.5)
Zensar Technologies · IT Services & Consulting
- Hyderabad, Telangana, India
- On-site
- Posted yesterday
- Apply by 30 Oct
- Cybersecurity
About the job
Job Summary
We are looking for a SOC Analyst (L1.5) with hands-on experience in Security Operations, Security Monitoring, Incident Response, Threat Hunting, and SIEM technologies. The ideal candidate should have exposure to Logpoint SIEM and strong experience in handling security incidents, alert triage, and threat investigations in a 24x7 SOC environment.
Candidates with strong experience in Microsoft Sentinel, Splunk, QRadar, or ArcSight along with incident response and threat hunting capabilities will also be considered.
Key Responsibilities Security Monitoring & Incident Detection
Monitor and analyze security alerts generated from SIEM and integrated security tools.
Perform real-time alert triage and validate security incidents.
Investigate incidents related to malware, phishing, ransomware, insider threats, account compromise, privilege misuse, and unauthorized access.
Escalate incidents to L2/L3 teams as per defined processes.
Ensure adherence to incident response SLAs and SOC procedures.
Incident Response & Investigation
Perform incident investigation and root cause analysis.
Analyze logs from:
Windows Servers & Workstations
Linux Systems
Active Directory
Firewalls
IDS/IPS
EDR/XDR Solutions
Proxy & Email Security Platforms
Cloud Platforms (Azure, AWS, GCP)
Support containment, eradication, recovery, and remediation activities.
Document incidents, findings, and recommendations.
Threat Hunting & Threat Intelligence
Perform proactive threat hunting activities.
Utilize MITRE ATT&CK Framework for threat mapping and analysis.
Analyze Indicators of Compromise (IOC) and Indicators of Attack (IOA).
Correlate threat intelligence with internal security events.
Identify suspicious user and system behavior.
SIEM Operations
Monitor and manage Logpoint SIEM use cases and alerts.
Support correlation rule tuning and alert optimization.
Create and maintain dashboards, reports, and custom searches.
Validate log ingestion and monitor SIEM health.
Reduce false positives through continuous tuning activities.
Required Technical Skills SIEM Technologies
Logpoint SIEM (Preferred)
Microsoft Sentinel
Splunk
IBM QRadar
ArcSight
Security Technologies
Microsoft Defender
CrowdStrike
SentinelOne
Palo Alto
Fortinet
Check Point
Cisco Security Solutions
IDS/IPS
Email Security Solutions
Threat & Security Operations
Security Monitoring
Incident Response
Alert Triage
Incident Investigation
Threat Hunting
Threat Intelligence
Malware Analysis
Phishing Investigation
Event Correlation
Root Cause Analysis
Operating Systems & Networking
Windows Administration
Linux Administration
TCP/IP
DNS
DHCP
VPN
HTTP/HTTPS
SMTP
Network Security Concepts
Security Frameworks
MITRE ATT&CK
Cyber Kill Chain
NIST Incident Response Lifecycle
Threat Intelligence Concepts
Qualifications
Bachelor's Degree in Computer Science, Information Technology, Cyber Security, or related field.
3+ years of SOC Operations experience.
Experience working in a 24x7 SOC environment.
Strong analytical and troubleshooting skills.
Good verbal and written communication skills.
Preferred Certifications
SC-200 (Microsoft Security Operations Analyst)
CEH
CompTIA Security+
Logpoint Certified Analyst
Splunk Certifications
Ideal Candidate
3-6 years of SOC experience.
Hands-on exposure to Logpoint SIEM is highly desirable.
Strong experience with Microsoft Sentinel, Splunk, QRadar, or ArcSight.
Experience in Incident Response, Alert Triage, Threat Hunting, Security Monitoring, and Threat Intelligence.
Exposure to CrowdStrike, Defender, SentinelOne, Palo Alto, or Fortinet.
Willingness to work from Hyderabad in 24x7 rotational shifts.
Key Responsibilities
Security Monitoring & Incident Detection
Monitor and analyze security alerts generated from SIEM and integrated security tools.
Perform real-time alert triage and validate security incidents.
Investigate incidents related to malware, phishing, ransomware, insider threats, account compromise, privilege misuse, and unauthorized access.
Escalate incidents to L2/L3 teams as per defined processes.
Ensure adherence to incident response SLAs and SOC procedures.
Incident Response & Investigation
Perform incident investigation and root cause analysis.
Analyze logs from: - Windows Servers & Workstations
Linux Systems
Active Directory
Firewalls
IDS/IPS
EDR/XDR Solutions
Proxy & Email Security Platforms
Cloud Platforms (Azure, AWS, GCP)
Support containment, eradication, recovery, and remediation activities.
Document incidents, findings, and recommendations.
Threat Hunting & Threat Intelligence
Perform proactive threat hunting activities.
Utilize MITRE ATT&CK Framework for threat mapping and analysis.
Analyze Indicators of Compromise (IOC) and Indicators of Attack (IOA).
Correlate threat intelligence with internal security events.
Identify suspicious user and system behavior.
SIEM Operations
Monitor and manage Logpoint SIEM use cases and alerts.
Support correlation rule tuning and alert optimization.
Create and maintain dashboards, reports, and custom searches.
Validate log ingestion and monitor SIEM health.
Reduce false positives through continuous tuning activities.