Senior Analyst

– Senior SOC Analyst

Role Overview

Key Responsibilities

• Monitor and investigate security alerts, events and incidents across enterprise IT infrastructure.
• Perform L1/L2 security incident triage, analysis, escalation and documentation.
• Manage and troubleshoot SIEM platforms, preferably Wazuh, including log collection, detection rules and dashboards.
• Develop and maintain SOAR automation workflows using Shuffle or equivalent platforms.
• Integrate security solutions such as firewalls, Active Directory, Microsoft Entra ID, Microsoft 365, EDR, DLP and PAM with SIEM/SOAR platforms.
• Implement and troubleshoot integrations using REST APIs, webhooks, Syslog, JSON and log forwarding mechanisms.
• Integrate SIEM/SOAR platforms with ITSM tools for automated incident creation, tracking and escalation.
• Investigate malware, phishing, suspicious logins, brute-force attacks and other security threats.
• Support threat hunting, vulnerability monitoring and MITRE ATT&CK-based detection use cases.
• Prepare incident reports, operational dashboards, SOPs and troubleshooting documentation.
• Coordinate with infrastructure and application teams for incident investigation and remediation.

Required Technical Skills

• Hands-on experience with SIEM platforms such as Wazuh, Splunk or Microsoft Sentinel.
• Working knowledge of SOAR platforms such as Shuffle or Cortex XSOAR.
• Understanding of REST APIs, webhooks, JSON, Syslog and security tool integrations.
• Knowledge of Windows Security Events, Active Directory and Microsoft Entra ID.
• Understanding of firewalls, VPN, TCP/IP, DNS and endpoint security.
• Familiarity with EDR, DLP, PAM and vulnerability management solutions.
• Basic scripting knowledge in Python or PowerShell.
• Knowledge of incident response processes and MITRE ATT&CK framework.

Experience and Qualifications

• 2–4 years of hands-on experience in SOC or Security Operations.
• Practical experience in SIEM monitoring, incident investigation and security event analysis.
• Exposure to SIEM/SOAR implementation, integration and troubleshooting.
• Good analytical, communication and documentation skills.

Preferred Certifications

• Microsoft SC-200
• CompTIA Security+ / CySA+
• Certified SOC Analyst (CSA)
• Blue Team Level 1 (BTL1)

Preferred Tools and Technologies