SOC Analyst L1

As a SOC Analyst L1, you will monitor and triage cybersecurity alerts from multiple sources (SIEM/EDR/network), determine whether activity is benign or suspicious, document evidence clearly, and escalate confirmed or potentially high-risk cases following playbooks and SLAs. Responsibilities: • Monitor security events and alerts in SIEM and defensive tools; perform initial triage and classification (benign / false positive / suspicious / incident). • Collect and review basic evidence: endpoint telemetry, Windows/Linux logs, firewall/IDS, DNS/proxy; perform initial correlation (host/user/IP/IOC/process). • Execute runbooks/playbooks (e.g., password reset request, IOC block request, host isolation request) when authorized and aligned with procedures. • Create and maintain high-quality tickets with a clear narrative: what happened, supporting evidence, potential impact, actions taken, recommended next steps. • Escalate to L2/L3/IR when there is evidence of compromise, material risk, lateral movement, or uncertainty that requires deeper investigation. • Deliver structured shift handovers (case status, findings, hypotheses, next steps, blockers). • Meet operational SLAs and documentation of quality standards. Requirements • 0–2 years in SOC/NOC/IT Security operations or equivalent hands-on experience demonstrated via labs/casework. • Solid fundamentals in networking: TCP/IP, DNS, HTTP/S, VPN, NAT. • Basic working knowledge of Windows and Linux (processes, authentication, logging concepts). • Ability to interpret log fields (source/destination, user, process, hash, URL, action, result). • Strong spoken and written English (minimum B2) — must be able to join technical calls and write clear tickets and summaries in English. • Strong attention to detail, structured thinking, prioritization, and ability to work under pressure and repetitive workflows without quality loss. • Experience with SIEM/EDR/IDS tools (e.g., Wazuh, Splunk, Sentinel, QRadar; Defender/CrowdStrike; Suricata/Snort). (Nice to have ) • Basic query skills (KQL/SPL/Lucene/DQL) and familiarity with MITRE ATT&CK concepts. (Nice to have ) • Entry-level certifications (e.g., Security+, BTL1, CySA+) or equivalent proof of competence. (Nice to have )