Soc l1 cyber security analyst

The Level 1 (L1) Cyber Security Analyst is the first line of defense within our 24/7 Security Operations Center (SOC). This role is responsible for the real-time monitoring, analysis, and triage of security alerts to identify and respond to potential cyber threats. The analyst will play a critical role in incident response and initial managed security services, ensuring the continuous security posture of our clients' digital infrastructure.

Key Responsibilities 1. Security Monitoring and Triage

Continuously monitor security alerts and events from various sources, including SIEM (Security Information and Event Management), EDR (Endpoint Detection and Response), IDS/IPS, and other security tools.

Analyze and triage security alerts to identify potential security incidents, and determine their legitimacy, severity, and potential impact.

Distinguish between false positives and legitimate security threats through initial investigation and log analysis.

Categorize and prioritize security incidents based on established procedures and severity levels.

2. Incident Response and Initial Containment

Serve as the first responder to security incidents, initiating the incident response process according to established playbooks.

Execute initial containment actions, such as isolating affected systems or endpoints, to prevent the spread of threats.

Gather and preserve forensic data and relevant logs for further investigation by higher-tier analysts.

Provide detailed, accurate, and timely documentation of incidents, including a summary of findings and actions taken.

Escalate confirmed incidents and more complex investigations to Level 2 (L2) analysts or senior incident response teams as needed.

3. Managed Security Services and Device Health

Monitor the health and status of security devices and tools, such as firewalls, SIEM, and EDR agents, to ensure they are operating effectively.

Perform initial troubleshooting of security device issues and elevate to appropriate engineering teams when necessary.

Contribute to the tuning and improvement of security monitoring rules and alerts under supervision.

Fully managed security services of client’s customers and ensure Monitoring and Protection of customers against DDo S Attacks. This also includes but not limited to: DDo S protection operation, Software updates, Patching, Health checks, Preventive maintenance and RMA

4. Shift Operations and Collaboration

Work on a 24/7 rotational shift schedule, including nights, weekends, and holidays, to ensure continuous security coverage.

Participate in seamless shift handover processes, providing comprehensive updates to incoming team members.

Collaborate effectively with team members and other IT and security departments to ensure a coordinated response to security events.

Required Skills and Qualifications Education:

Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or a related field, or equivalent experience.

Experience:

1-3 years of experience in a Security Operations Center (SOC) or a similar cybersecurity role is preferred, with exposure to a Managed Security Service Provider (MSSP) environment being a plus.

Certifications (Preferred):

Comp TIA Security+ or similar fundamental security certifications.

Certified SOC Analyst (CSA) or GIAC Security Essentials (GSEC).

Technical Skills:

Basic understanding of cybersecurity principles, networking protocols (TCP/IP), and operating systems (Windows, Linux).

Experience with SIEM platforms (e.g., Splunk, QRadar, Microsoft Sentinel, Log Rhythm) for log analysis and monitoring.

Familiarity with incident response procedures and frameworks.

Soft Skills:

Strong analytical and problem-solving abilities.

Excellent written and verbal communication skills for incident documentation and reporting.

High attention to detail and ability to remain focused during routine monitoring.

Ability to work effectively under pressure and in a fast-paced, 24/7 environment. #J-18808-Ljbffr