Security Operations Center Analyst

Alvaria CX; India; Híbrido; INR 600 000 - 1 200 000; Tempo integral

Resumo da oferta

Alvaria CX is seeking an entry‑level SOC Analyst I to monitor and triage security alerts across endpoints, identity, email, network, and cloud telemetry. You will work within CSOC playbooks, perform initial investigations, document evidence, and escalate when deeper analysis is needed.

The role targets early-career security professionals aiming to build strong foundations in incident response, threat detection, and security operations in a global enterprise setting.

Qualificações

• Bachelor's degree in Cybersecurity, Information Security, Computer Science, Information Technology, or related field.

Responsabilidades

• Monitor and triage alerts from SIEM, EDR, identity, email security, vulnerability management, and cloud security platforms.

Conhecimentos

SIEM concepts

EDR concepts

Windows fundamentals

Linux fundamentals

TCP/IP basics

DNS basics

HTTP/HTTPS basics

KQL basics

Phishing analysis

Security ticketing

Formação académica

Bachelor's degree in Cybersecurity/Information Security/CS/IT

Ferramentas

Microsoft Sentinel

Microsoft Defender

Sophos

Tenable

Freshservice/ServiceNow

Descrição da oferta de emprego

Security Operations Center (SOC) Analyst I

Department: Cybersecurity Operations Center (CSOC)

Employment Type: Full-Time

Work Arrangement: Bangalore-based; remote/hybrid options negotiable after onboarding

Role focus: Monitor, validate, triage, document, and escalate. Build strong investigation fundamentals while operating within established CSOC procedures.

Job Summary

The Security Operations Center (SOC) Analyst I is an entry-level cybersecurity role responsible for monitoring, validating, and triaging security alerts across endpoint, identity, email, network, vulnerability, and cloud security telemetry. The analyst performs initial investigation, documents evidence, follows established CSOC playbooks, and escalates events that require deeper analysis or response. This role is designed for early-career security professionals who want to build strong foundations in security operations, incident response, and threat detection in a global enterprise environment.

Key Responsibilities

• Monitor and triage alerts from SIEM, EDR, identity, email security, vulnerability management, and cloud security platforms.
• Perform initial analysis using platforms such as Microsoft Sentinel, Microsoft Defender, Sophos, Tenable, and equivalent enterprise security tools.
• Validate alert context, identify affected users and assets, gather relevant evidence, establish an initial timeline, and categorize or elevate events according to CSOC procedures.
• Investigate common SOC scenarios including phishing, suspicious authentication, endpoint alerts, user-reported security events, and endpoint health issues.
• Use basic KQL and approved search or hunting capabilities to retrieve and correlate security telemetry.
• Create and maintain clear security tickets that capture evidence, actions taken, current state, escalation rationale, and next steps.
• Support vulnerability tracking, remediation follow-up, and validation of security findings.
• Preserve investigation evidence and follow Alvaria data handling and security requirements throughout the investigation lifecycle.
• Collaborate with global security, IT, identity, endpoint, cloud, and infrastructure teams when additional investigation or remediation is required.
• Follow established SOPs and playbooks and contribute updates to knowledge articles as recurring investigation patterns are identified.

Required Qualifications

• Bachelor's degree in Cybersecurity, Information Security, Computer Science, Information Technology, or a related technical field.
• 1+ years of experience in cybersecurity, helpdesk, technical support, systems administration, or a related technical role.
• Foundational understanding of SIEM, EDR, identity security, endpoint security, and vulnerability management concepts.
• Working knowledge of Windows and Linux fundamentals plus TCP/IP, DNS, HTTP/HTTPS, and common network troubleshooting concepts.
• Basic understanding of Microsoft 365 and identity concepts such as authentication, MFA, account activity, and access events.
• Basic KQL or similar security-query experience with the ability to retrieve and interpret event data.
• Ability to analyze phishing messages, suspicious sign-ins, endpoint alerts, and other common security events using documented procedures.
• Strong written communication, attention to detail, and ticket documentation skills.
• Ability to manage assigned work reliably, recognize when escalation is required, and operate effectively in a team environment.

Preferred Skills and Certifications

• CompTIA Security+ and/or Microsoft Certified: Security Operations Analyst Associate (SC-200), completed or in progress.
• Experience with ITSM platforms such as Freshservice or ServiceNow.
• Exposure to Microsoft Entra ID, Microsoft Defender, Microsoft Sentinel, Sophos, Tenable, or comparable enterprise security platforms.
• Foundational knowledge of AWS or other cloud environments and cloud security concepts.
• Exposure to PowerShell or Python for security analysis, data handling, or task automation.
• Demonstrated interest in developing toward incident investigation, threat hunting, detection engineering, or cloud security responsibilities.

Success in This Role

Success is demonstrated through accurate triage, disciplined evidence collection, clear ticket documentation, timely escalation, and continued growth toward independent investigation and threat hunting capabilities.