L1 SOC Security Analyst SIEM SOAR UEBA

Black Box; Gurgaon; On-site; INR 800,000 - 1,200,000; Full time

Job summary

Black Box is seeking a vigilant SOC Analyst to monitor SIEM, SOAR and UEBA platforms in a 24/7 operations center in Gurgaon. You will perform initial triage, validate security incidents, and classify alerts according to SOPs.

You will also manage log ingestion, platform health, automated workflows, and incident ticketing, escalating issues to the L2 team when needed and coordinating with IT during incident response to restore services and ensure documentation aligns with SLAs.

Qualifications

• Experience monitoring SIEM, SOAR and UEBA platforms in 24x7 SOC.
• Proficient in initial triage, incident validation and alert classification per SOPs.
• Knowledge of log collection, platform health, automation workflows and data ingestion.
• Experience creating incident tickets and maintaining investigation records.

Responsibilities

• Monitor SOC platforms 24x7 for security events and alerts.
• Perform initial triage, validate incidents, and classify alerts per SOPs.
• Track log collection, platform health, automation workflows, and data ingestion.
• Create and update incident tickets and maintain investigation records.
• Escalate confirmed incidents and issues to L2 team.
• Coordinate with IT and security during incident response and service restoration.
• Verify execution of automated playbooks and security workflows.
• Adhere to SOC processes, SLAs, escalation matrix and documentation standards.

Skills

SIEM monitoring

Incident triage

SOP adherence

Documentation

Tools

SIEM

SOAR

UEBA

Job description

Job Description:

• Monitor SIEM, SOAR, and UEBA platforms on a 24×7 basis for security events and alerts.
• Perform initial triage, validate security incidents, and classify alerts based on SOPs.
• Monitor log collection, platform health, automation workflows, and data ingestion status.
• Create and update incident tickets, maintain investigation records, and prepare operational reports.
• Escalate confirmed security incidents, failed automation workflows, and anomalous user activities to the L2 team.
• Coordinate with IT and security teams during incident response and service restoration.
• Verify the successful execution of automated playbooks and security workflows.
• Adhere to SOC processes, SLAs, escalation matrix, and documentation standards.

Requirements: