Associate SOC Analyst

ISA; Maharashtra; On-site; INR 600,000 - 1,000,000; Full time

Job summary

ISA in Maharashtra, India, is seeking a Security Operations Analyst to monitor and respond to security incidents using SIEM and EDR technologies. You will craft detection rules, tune alerts, and build SOAR playbooks to automate routine SOC tasks while collaborating with threat intel and IT teams.

The ideal candidate has hands-on SOC experience, knowledge of MITRE ATT&CK, and certifications such as CEH or CySA+.

Qualifications

• Bachelor's degree in CS/IT/EC or related engineering field.
• Experience writing and tuning SIEM detection rules with improved alert fidelity.
• Hands-on experience in Incident Response, Alert Triage, Threat Hunting, Malware Analysis, and Ransomware Investigation.
• KQL is mandatory; SPL or equivalent SIEM query language knowledge.
• SOAR playbooks design/implementation; automation for alert enrichment and automated containment actions.
• Working knowledge of MITRE ATT&CK and relevant certifications (SC-200, CEH, CySA+).

Responsibilities

• Investigate, analyze, and respond to security incidents with deep-dive EDR analysis.
• Reduce MTTD/MTTR through structured investigations and playbooks.
• Write, tune, and optimize detection queries and use cases.
• Build and maintain behavior-based detections and reduce false positives.
• Conduct threat hunting using SIEM, EDR, and security telemetry.

Skills

Incident Response

Alert Triage

Threat Hunting

Malware Analysis

Ransomware Investigation

SOAR Playbooks

Workflow Automation

MITRE ATT&CK

SOC Operations

Education

Bachelors degree in CS/IT/EC or related engineering

Microsoft SC-200 Certification

CEH Certification

CompTIA CySA+

Tools

KQL

SPL

Microsoft Sentinel

Splunk

Datadog

CrowdStrike

Job description

Job Purpose

Responsible for monitoring and investigating security events, responding to cybersecurity incidents, and supporting threat detection and hunting activities using SIEM and EDR platforms. Assists in developing detection content, identifying monitoring gaps, optimizing alerts, and implementing SOAR automation to improve incident response effectiveness and strengthen the organization's security operations capabilities

Job Purpose

Responsible for monitoring and investigating security events, responding to cybersecurity incidents, and supporting threat detection and hunting activities using SIEM and EDR platforms. Assists in developing detection content, identifying monitoring gaps, optimizing alerts, and implementing SOAR automation to improve incident response effectiveness and strengthen the organization's security operations capabilities

Key Result Responsibilities

• Investigate, analyze, and respond to security incidents, perform deep-dive EDR analysis to identify threats, assess impact, and support containment and remediation activities.
• Reduce Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR) through effective incident handling, structured investigation workflows, and adherence to response playbooks.
• Write, tune, and optimize detection queries and use cases to enhance threat detection and support proactive threat hunting activities.
• Build and maintain behavior-based detections, identify detection gaps, and implement improvements to strengthen monitoring capabilities.
• Perform alert tuning and rule optimization to reduce false positives and improve detection accuracy.

Key Result Responsibilities-Continued

• Conduct threat hunting activities using SIEM, EDR, and security telemetry to identify suspicious activities and emerging threats
• Design, implement, and maintain SOAR playbooks to automate repetitive SOC tasks and improve operational efficiency
• Integrate SOAR platforms with SIEM, EDR, and threat intelligence solutions to streamline end-to-end incident response processes
• Collaborate with SOC analysts, threat intelligence teams, and IT/infrastructure teams during incident investigation, containment, remediation, and continuous improvement initiatives

Qualifications (Academic, Training, Languages)

• Bachelor’s degree in computer science, Information Technology, Electronics, or a related engineering discipline.
• Demonstrated experience writing and tuning SIEM detection rules with measurable improvement in alert fidelity
• Incident Response, Alert Triage, Threat Hunting, Malware Analysis, Ransomware Investigation
• KQL (mandatory), SPL or equivalent SIEM query language
• SIEM rule creation, behavioral analytics, alert tuning, false positive reduction
• Hands-on experience designing and implementing SOAR playbooks
• Workflow automation for alert enrichment, and automated containment actions
• Practical experience implementing or maintaining SOAR playbooks in a production SOC environment
• Working knowledge of the MITRE ATT&CK framework and its application to detection coverage
• Microsoft SC-200: Security Operations Analyst
• CEH or equivalent incident handling certification
• CompTIA CySA+
• Microsoft Sentinel, Datadog Splunk, Securonix, LogRhythm, or equivalent
• Microsoft Defender, CrowdStrike, or equivalent

Work Experience

With 1–2 years of hands-on experience in a SOC or security operations environment.