SOC Analyst

Flynaut; Pune District; On-site; INR 600,000 - 900,000; Full time

Job summary

Flynaut is seeking a SOC Analyst to monitor, investigate, and respond to security events across client environments. You will use enterprise tools and cloud platforms, and communicate findings clearly to both technical teams and executives.

The role demands strong written reporting and steady incident handling across time zones. The ideal candidate has 1–3 years in a SOC or IT security role, with hands-on SIEM experience (Microsoft Sentinel or Splunk) and familiarity with Microsoft 365 security

Qualifications

• Proficient in monitoring alerts from SIEM/EDR/email security and DNS tools.
• Able to triage incidents and document reasoning for true/false positives.

Responsibilities

• Monitor alerts across SIEM, EDR, email security and DNS filtering platforms.
• Triage and investigate events, separating true and false positives with documented reasoning.
• Contain incidents using runbooks and elevate Sev 1/2 to senior analysts and CISO.
• Write incident reports for technical teams and executives with/without security background.
• Keep clients updated during active incidents with status, containment actions and timelines.
• Analyse phishing emails and report findings through defined channels.
• Analyse logs across Microsoft 365, Entra ID, AWS CloudTrail and endpoint management platforms.
• Keep ticket documentation accurate and current during investigations.
• Participate in post-incident reviews and improve runbooks.
• Track vulnerabilities and coordinate patch updates with system owners.

Skills

Incident response

Written communication

Security incident reporting

Threat analysis

Education

SC-200

Tools

Microsoft Sentinel

Splunk

Microsoft 365 security tools

Purview Audit

Entra ID sign-in logs

Job description

We're hiring a SOC Analyst to join our Security Operations Center. You'll monitor, investigate and respond to security events across client environments, using enterprise tools and cloud platforms.

This role needs technical depth and clear communication in equal measure. During an incident, you're the person clients and internal teams hear from, and your written reports need to be as sharp as your investigations.

What you'll do

• Monitor alerts across SIEM, EDR, email security and DNS filtering platforms
• Triage and investigate events, separating true and false positives with documented reasoning
• Contain incidents using defined runbooks, and elevate Sev 1 and Sev 2 events to senior analysts and the CISO
• Write clear incident reports for both technical teams and executives with no security background
• Keep clients updated during active incidents: status, containment actions, next steps and timelines
• Analyse phishing emails and report findings through defined channels
• Analyse logs across Microsoft 365, Entra ID, AWS CloudTrail and endpoint management platforms
• Keep ticket documentation accurate and current throughout every investigation
• Take part in post-incident reviews and help improve runbooks
• Track vulnerabilities and coordinate patch updates with system owners

What we're looking for

Experience

• Level 1: 1 to 3 years in a SOC, security helpdesk or IT security role
• Level 2: 3 to 5 years

Technical skills

• Hands-on experience with a SIEM (Microsoft Sentinel, Splunk or similar)
• Microsoft 365 security tools: Defender for Endpoint, Defender for Office 365, Purview Audit, Entra ID sign-in logs
• MITRE ATT&CK and kill chain methodology
• Reading Windows Event Logs, Azure/Entra sign-in logs and email headers
• AWS or Azure experience is a plus
• Clear, professional written English, without jargon when the audience doesn't need it
• Can write an incident summary a CEO can act on, and a technical timeline an engineer can follow
• Comfortable giving live updates to clients during incidents, including delivering bad news calmly
• Responds promptly and transparently, so stakeholders always know what's happening
• Understands that communication during an incident is itself a security control

Mindset

• Curious and methodical. Follows evidence, not assumptions.
• Owns tickets end to end and never hands off without context
• Asks questions when scope is unclear instead of guessing
• Works well across time zones with US and India teams

Preferred certifications

• SC-200 (Microsoft Security Operations Analyst)