SOC Analyst | Offshore | Unitedlex

Please find the attached JD. Also I have updated the experience requirement to 3–8 years. However, the experience we are looking for should be relevant SOC experience and not the candidate’s total IT experience.

Sometimes candidates transition from other domains into SOC and may have limited SOC experience despite having extensive overall IT experience. Such candidates can still be considered if they demonstrate strong learning ability, adaptability, and good grasping skills and came from a networking background.

REQUIREMENTS & COMPETENCIES:

• Bachelor’s degree.

• 3-8 years of experience of working in Security operations and Incident response.

• Hands-on experience with Hunter SIEM platform.

• Hands-on experience with SentinelOne and Microsoft Defender (EDR/XDR).

• Experience in creating detection rules, correlation logic, log onboarding, and SIEM content

management.

• Strong understanding of networking concepts and protocols including TCP/IP, DNS, HTTP/S,

SMTP, VPN, and firewall technologies

• Prior experience detecting, analyzing, and responding to security incidents.

• Demonstrated ability to analyze and correlate information from a wide variety of enterprise

technologies.

• Knowledge of MITRE ATT&CK framework and experience mapping security detections and

incidents to ATT&CK tactics and techniques a plus.

• Familiarity with cloud security monitoring and threat intelligence concepts.

• Strong experience working on scanning tool like Rapid 7.

• Ability to work in a 24x7 rotational SOC environment and handle high-severity incidents.

• Good communication and documentation skills.

RESPONSIBILITIES:

• Provide 24x7 monitoring, detection, triage, investigation, and incident response activities as

part of the Security Operations Center.

• Monitor and analyze security events and alerts across multiple technologies to identify

suspicious and malicious activities.

• Monitor and manage security technologies including Hunter SIEM, SentinelOne, Microsoft

Defender, IDS/IPS, vulnerability scanners (Rapid 7), and related security monitoring tools.

• Conduct proactive threat hunting activities to identify potential threats and indicators of

compromise.

• Investigate security alerts and incidents, determine root cause, and support containment,

remediation, and recovery activities.

• Identify successful and unsuccessful intrusion attempts through event correlation and analysis

across various security platforms.

• Ensure timely escalation and proper hand-off of security incidents for remediation and

closure.

• Develop, maintain, and optimize SIEM use cases, detection rules, filters, and alert

configurations to improve visibility and reduce false positives.

• Onboard and manage log sources and ensure proper log collection and monitoring within the

SIEM platform.

• Monitor SIEM platform health, log ingestion status, and availability of security monitoring

tools.

• Manage and track security incidents and tickets in accordance with defined SLAs.

• Support incident response activities and maintain complete documentation throughout the

incident lifecycle.

• Collaborate with internal teams, application owners, and external vendors to support security

initiatives and projects.

• Participate in shift handover activities to ensure continuity in 24x7 SOC operations.

• Continuously identify and implement opportunities for security process improvement and

enhancement of the organization’s security posture.

Originally posted on Himalayas