Monitor and analyze security alerts from multiple SIEM platforms to detect and escalate potential security incidents.
- Lead triage, investigation, and response of complex security incidents, performing root cause analysis and coordinating remediation efforts.
- Develop, maintain, and execute incident response playbooks and procedures.
- Conduct advanced threat hunting using threat intelligence, MITRE ATT&CK framework, and IOC (Indicators of Compromise) analysis.
- Manage endpoint and network security tools including EDR / XDR solutions, firewalls, IDS / IPS to detect and mitigate threats.
- Collaborate with vulnerability management teams to prioritize and remediate security risks using tools like Nessus, Qualys, or Rapid7.
- Automate security processes through SOAR platforms and contribute to continuous improvement of SOC workflows.
- Prepare detailed incident reports and post-mortems for stakeholders and compliance audits.
- Maintain compliance with industry security frameworks such as NIST, ISO 27001.
- Use ticketing and case management tools (ServiceNow, JIRA) for efficient incident tracking and resolution.
- Mentor and support junior SOC analysts in incident handling and escalation protocols.
Required Skills & Minimum 5 years of experience in SOC roles, specifically in Level 3 and Level 4 analyst positions.
Hands-on expertise with SIEM tools such as Splunk, QRadar, Azure Sentinel, ArcSight, or LogRhythm.Proficient in threat intelligence analysis, threat hunting methodologies, and MITRE ATT&CK framework.Strong experience with endpoint and network security technologies including EDR / XDR tools (CrowdStrike, Microsoft Defender, Carbon Black), firewalls, IDS / IPS.Skilled in incident response techniques : malware analysis, log correlation, root cause analysis, and playbook execution.Working knowledge of vulnerability management tools like Nessus, Qualys, Rapid7.Experience using ticketing systems such as ServiceNow or JIRA for incident management.Solid understanding of SOC processes, security automation (SOAR), and compliance frameworks (NIST, ISO 27001).Knowledge of Wazuh SIEM / EDR tools is a plus.Strong analytical, communication, and collaboration skills with ability to work under pressure in a fast-paced environment(ref : hirist.tech)