SOC Analyst

Security Operations Center (SOC) Analyst

We are seeking a dedicated SOC Analyst responsible for continuous 24/7 monitoring, detection, triage, and response to security incidents across the entire security infrastructure. This role involves managing tools such as Trend Micro security solutions, Microsoft Sentinel (SIEM), and related cybersecurity platforms. Additionally, the analyst supports initiatives related to data loss prevention (DLP), patch compliance, and vulnerability management to ensure rapid threat identification, timely remediation of vulnerabilities, and safeguarding of sensitive information.

Core Responsibilities:

Security Monitoring & Incident Management

• Oversee alerts and dashboards generated by Trend Micro products (e.g., Vision One, Deep Security, Apex One), Microsoft Sentinel, and other security tools.
• Perform alert triage to differentiate genuine threats from false positives, prioritizing based on severity and potential impact to the business.
• Conduct investigations into suspicious activities utilizing log analysis, KQL queries, and threat intelligence sources.
• Escalate validated security incidents to Level 2/Level 3 analysts or incident response teams with comprehensive evidence documentation.
• Implement initial containment procedures following established playbooks, such as endpoint isolation or indicator blocking.
• Adjust detection rules and alert thresholds to minimize false alarms and improve detection accuracy.

Data Loss Prevention (DLP) Oversight

• Monitor and analyze DLP alerts related to unauthorized data transfer, sharing, or exfiltration attempts.
• Investigate policy violations to determine if incidents are accidental, negligent, or malicious, escalating cases as necessary.
• Review and optimize DLP policies and rules to reduce false positives and improve detection precision.
• Collaborate with data owners, HR, and compliance teams on confirmed data leakage incidents.
• Generate reports on DLP incident trends and evaluate policy effectiveness.

Vulnerability and Patch Management

• Execute and review vulnerability scans using tools such as Tenable or similar platforms.
• Prioritize vulnerabilities based on severity scores (CVSS), exploitability, and asset importance.
• Create and track remediation tickets, ensuring timely resolution and escalating overdue issues.
• Manage risk acceptance and exception requests with appropriate justification documentation.
• Develop vulnerability and compliance reports to support management decision-making and audit processes.

Documentation & Reporting

• Record incidents and investigative activities within ticketing systems like ServiceNow.
• Maintain and update SOC playbooks, runbooks, and standard operating procedures (SOPs).
• Prepare shift handover notes and periodic security reports for stakeholders.
• Assist with audits, compliance verifications, and post-incident reviews to enhance security posture.

Qualifications:

• Diploma or Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or an equivalent field of study.
• 2-4 years of experience in a Security Operations Center, security operations, or IT security role.
• Practical experience with SIEM platforms (preferably Microsoft Sentinel) and endpoint or XDR security tools (preferably Trend Micro).
• Knowledge of vulnerability scanning tools such as Tenable and familiarity with patch management processes.
• Understanding of Data Loss Prevention concepts, incident response lifecycle, and the MITRE ATT&CK framework.
• Preferred certifications include: CompTIA Security+, Microsoft SC-200, or Trend Micro certifications.
• Additional desirable certifications: CEH, GCIH, GCIA, Tenable, or cloud security certifications for Azure/AWS.

Technical Skills:

• In-depth knowledge of network security, endpoint protection, cloud security, and operating systems (Windows, Linux).
• Proficiency in writing and interpreting KQL queries and analyzing logs for security insights.
• Familiarity with security technologies such as firewalls, IDS/IPS, WAFs, EDR/XDR, DLP solutions, and vulnerability scanners.
• Understanding of CVSS scoring systems, CVE tracking, and risk-based vulnerability remediation strategies.
• Strong analytical skills, meticulous attention to detail, and excellent written and verbal communication abilities.
• Ability to collaborate effectively with infrastructure and application teams to facilitate remediation efforts.
• Capable of maintaining composure and delivering results under pressure, including during shift rotations.