SOC ANALYST

Responsible for 24x7 monitoring, detection, triage, and response to security events across the security stack, including Trend Micro, Microsoft Sentinel (SIEM), and related tools. Also supports data loss prevention (DLP), patch compliance, and vulnerability management to ensure threats are detected quickly, weaknesses are remediated on time, and sensitive data remains protected.

Key Responsibilities:

Security Monitoring & Incident Response

Monitor alerts and dashboards across Trend Micro (e.g. Vision One, Deep Security, Apex One), Microsoft Sentinel, and other security tools

Triage alerts, separate true from false positives, and prioritize by severity and business impact

Investigate suspicious activity using log analysis, KQL queries, and threat intelligence

Escalate confirmed incidents to L2/L3 or the incident response team with clear evidence

Perform initial containment per playbooks, such as isolating endpoints or blocking indicators

Tune detection rules and alert thresholds to reduce noise

Data Loss Prevention (DLP)

Monitor and triage DLP alerts for unauthorized transfer, sharing, or exfiltration of sensitive data

Investigate policy violations, determine whether they are accidental, negligent, or malicious, and escalate as required

Review and tune DLP policies and rules to reduce false positives

Coordinate with data owners, HR, and compliance on confirmed data leakage incidents

Report DLP incident trends and policy effectiveness

Vulnerability Management

Run and review vulnerability scans using Tenable and similar tools

Prioritize findings by severity (CVSS), exploitability, and asset criticality

Raise remediation tickets, track them to closure, and escalate overdue items

Manage risk acceptance and exception requests with supporting justification

Produce vulnerability and patch compliance reports for management and audits

Documentation & Reporting

Document incidents and investigations in the ticketing system (e.g. ServiceNow)

Maintain SOC playbooks, runbooks, and SOPs

Prepare shift handover notes and regular security reports

Support audits, compliance checks, and post-incident reviews

Qualifications:

Diploma or Bachelor's degree in Cybersecurity, IT, Computer Science, or a related field (or equivalent experience)

2-4 years in a SOC, security operations, or IT security role

Hands-on experience with a SIEM (Microsoft Sentinel preferred) and endpoint or XDR tools (Trend Micro preferred)

Experience with vulnerability scanners (Tenable preferred) and patch management processes

Understanding of DLP concepts and tools, and of the incident response lifecycle and MITRE ATT&CK

Preferred certifications: CompTIA Security+, Microsoft SC-200, or Trend Micro certifications

Nice to have: CEH, GCIH, GCIA, Tenable certifications, or Azure/AWS security certifications

Skills:

Strong knowledge of network, endpoint, cloud, and OS security (Windows, Linux)

Ability to write and read KQL queries and analyze logs

Familiarity with firewalls, IDS/IPS, WAF, EDR/XDR, DLP, and vulnerability scanners

Understanding of CVSS scoring, CVE tracking, and risk-based remediation prioritisation

Strong analytical thinking, attention to detail, and clear written and verbal communication

Ability to work with infrastructure and application teams to drive remediation

Calm and effective under pressure and in shift work