Soc Analyst 1

Crescendo Global Leadership Hiring India; Chengalpattu; On-site; INR 450,000 - 650,000; Full time

Job summary

Crescendo Global Leadership Hiring India invites applications for a SOC Analyst position in Chennai. The role focuses on 24x7 security monitoring, triage, and incident response using SIEM, SOAR, and EDR tools.

The successful candidate will perform first-level triage, run basic Splunk queries, and maintain incident documentation. The position requires 1–3 years in SOC or security operations, strong networking knowledge, and the ability to work night shifts in a rotating schedule.

Qualifications

• Hands‑on SIEM monitoring and incident triage experience.
• Knowledge of Splunk queries to enrich alerts with context.
• Familiarity with MITRE ATT&CK framework and alert triage.
• Experience using ticketing systems like ServiceNow, Jira, or similar.

Responsibilities

• Monitor real-time security alerts across SIEM, SOAR and EDR dashboards.
• Use Splunk for basic queries and enrich alerts with user/asset/network data.
• Log, categorize and document incidents and shift notes.
• Follow playbooks for phishing, malware, and endpoint security alerts.
• Escalate to L2/L3 with evidence and timelines.
• Collaborate with security, threat intel, and IT operations teams.

Skills

Splunk SPL

SIEM concepts

MITRE ATT&CK

Ticketing systems

Education

Bachelor's degree in Cybersecurity/CS/IT

Tools

Palo Alto Cortex XSOAR

Microsoft Defender for Endpoint

Job description

SOC Analyst 2-6+ years Chennai

We are looking for an experienced SOC Analyst – L1 to join a Cyber Fusion Centre and support 24x7 security monitoring and incident triage. The role involves working with SIEM, SOAR and EDR tools to investigate alerts, identify potential security incidents and lift cases appropriately.

Location –

Chennai

Your Future Employer –

A leading global organization offering an opportunity to work in a structured cybersecurity environment with exposure to enterprise security operations and advanced security tools.

Responsibilities –

1. Monitor real-time security alerts across SIEM, SOAR and EDR dashboards and perform first-level triage.
2. Use Splunk to conduct basic SIEM queries and enrich alerts with relevant user, asset, network and timeline information.
3. Log, categorize and escape?
4. Follow established playbooks for phishing, malware, suspicious login and endpoint security alerts.
5. Perform authorized Tier-1 containment actions, including endpoint isolation where applicable.
6. Maintain accurate shift notes, ticket documentation and incident summaries.
7. Ensure proper handover of open alerts and incidents between shifts.
8. Escalate incidents outside the defined playbook scope to L2/L3 teams with complete evidence and timelines.
9. Collaborate with security, threat intelligence, threat hunting and IT operations teams on security-related issues.
10. Contribute observations and edge cases to runbooks and knowledge-base documentation.

Requirements –

1. 1–3 years of hands‑on experience in a Security Operations Centre, security monitoring or IT operations role with security exposure.
2. Strong understanding of networking fundamentals including IP, DNS, ports and protocols.
3. Knowledge of endpoint fundamentals across Windows/macOS environments.
4. Familiarity with SIEM concepts and basic Splunk SPL/query construction.
5. Foundational understanding of the MITRE ATT&CK framework and its application to alert triage.
6. Experience working with ticketing systems such as ServiceNow, Jira or similar platforms.
7. Strong written communication skills with the ability to prepare clear incident summaries and shift notes.
8. Willingness to work in 24x7 rotational shifts, including nights, weekends and public holidays.
9. Bachelor's degree in Cybersecurity, Computer Science, Information Technology or a related field is preferred.
10. Exposure to SOAR/EDR platforms such as Palo Alto Cortex XSOAR and Microsoft Defender for Endpoint will be an advantage.

What is in it for you –

• Opportunity to build your career in cybersecurity and SOC operations.
• Hands‑on exposure to SIEM, SOAR and EDR technologies.
• Opportunity to work on real-time security monitoring and incident response.
• Exposure to enterprise‑level security operations and cross‑functional teams.
• Learning and development opportunities in the cybersecurity domain.

Disclaimer –

Crescendo Global specializes in Senior to C-level niche recruitment. We are passionate about empowering job seekers and employers with an engaging and memorable job search and leadership hiring experience. Crescendo Global does not discriminate on the basis of race, religion, color, origin, gender, sexual orientation, age, marital status, veteran status or disability status.

Note –

We receive a large number of applications on a daily basis, making it difficult for us to respond to every candidate individually. Please assume that your profile has not been shortlisted if you do not hear from us within 1 week. Your patience is highly appreciated.