SOC Analyst I

Alvaria; Bengaluru; Hybrid; INR 600,000 - 900,000; Full time

Job summary

Alvaria in Bengaluru, India is seeking an entry-level SOC Analyst I to monitor, validate, and triage security alerts across endpoints, identity, email, and cloud telemetry. You will follow CSOC playbooks, document evidence, and escalate events that require deeper analysis.

This role offers foundational experience in incident response and threat detection within a global enterprise, with Bangalore-based work and negotiable remote/hybrid options after onboarding.

Qualifications

• Bachelor's degree in Cybersecurity, Information Security, Computer Science, Information Technology, or a related technical field.
• 1+ years of experience in cybersecurity, helpdesk, technical support, systems administration, or a related technical role.
• Foundational understanding of SIEM, EDR, identity security, endpoint security, and vulnerability management concepts.
• Working knowledge of Windows and Linux fundamentals plus TCP/IP, DNS, HTTP/HTTPS, and common network troubleshooting concepts.
• Basic understanding of Microsoft 365 and identity concepts such as authentication, MFA, account activity, and access events.
• Basic KQL or similar security-query experience with the ability to retrieve and interpret event data.
• Ability to analyze phishing messages, suspicious sign-ins, endpoint alerts, and other common security events using documented procedures.
• Strong written communication, attention to detail, and ticket documentation skills.
• Ability to manage assigned work reliably, recognize when escalation is required, and operate effectively in a team environment.

Responsibilities

• Monitor and triage alerts from SIEM, EDR, identity, email security, vulnerability management, and cloud security platforms.
• Perform initial analysis using platforms such as Microsoft Sentinel, Microsoft Defender, Sophos, Tenable, and equivalent enterprise security tools.
• Validate alert context, identify affected users and assets, gather relevant evidence, establish an initial timeline, and categorize or elevate events according to CSOC procedures.
• Investigate common SOC scenarios including phishing, suspicious authentication, endpoint alerts, user-reported security events, and endpoint health issues.
• Use basic KQL and approved search or hunting capabilities to retrieve and correlate security telemetry.
• Create and maintain clear security tickets that capture evidence, actions taken, current state, escalation rationale, and next steps.
• Support vulnerability tracking, remediation follow-up, and validation of security findings.
• Preserve investigation evidence and follow Alvaria data handling and security requirements throughout the investigation lifecycle.
• Collaborate with global security, IT, identity, endpoint, cloud, and infrastructure teams when additional investigation or remediation is required.
• Follow established SOPs and playbooks and contribute updates to knowledge articles as recurring investigation patterns are identified.

Skills

Strong written communication

Attention to detail

Team collaboration

Reliable work management

Education

Bachelor's degree in Cybersecurity or related field

Tools

Microsoft Sentinel

Microsoft Defender

Sophos

Tenable

PowerShell

Job description

If you are unable to complete this application due to a disability, contact this employer to ask for an accommodation or an alternative application process.

SOC Analyst I

Security Full Time Indv. Contributor IN

Security Operations Center (SOC) Analyst I
Location: Bangalore, India
Department: Cybersecurity Operations Center (CSOC)
Employment Type: Full-Time Work Arrangement: Bangalore-based; remote/hybrid options negotiable after onboarding

Role focus:

Monitor, validate, triage, document, and build strong investigation fundamentals while operating within established CSOC procedures.

Job Summary

The Security Operations Center (SOC) Analyst I is an entry-level cybersecurity role responsible for monitoring, validating, and triaging security alerts across endpoint, identity, email, network, vulnerability, and cloud security telemetry. The analyst performs initial investigation, documents evidence, follows established CSOC playbooks, and escalates events that require deeper analysis or response. This role is designed for early-career security professionals who want to build strong foundations in security operations, incident response, and threat detection in a global enterprise environment.

Key Responsibilities

• Monitor and triage alerts from SIEM, EDR, identity, email security, vulnerability management, and cloud security platforms.
• Perform initial analysis using platforms such as Microsoft Sentinel, Microsoft Defender, Sophos, Tenable, and equivalent enterprise security tools.
• Validate alert context, identify affected users and assets, gather relevant evidence, establish an initial timeline, and categorize or elevate events according to CSOC procedures.
• Investigate common SOC scenarios including phishing, suspicious authentication, endpoint alerts, user-reported security events, and endpoint health issues.
• Use basic KQL and approved search or hunting capabilities to retrieve and correlate security telemetry.
• Create and maintain clear security tickets that capture evidence, actions taken, current state, escalation rationale, and next steps.
• Support vulnerability tracking, remediation follow-up, and validation of security findings.
• Preserve investigation evidence and follow Alvaria data handling and security requirements throughout the investigation lifecycle.
• Collaborate with global security, IT, identity, endpoint, cloud, and infrastructure teams when additional investigation or remediation is required.
• Follow established SOPs and playbooks and contribute updates to knowledge articles as recurring investigation patterns are identified.

Required Qualifications

• Bachelor's degree in Cybersecurity, Information Security, Computer Science, Information Technology, or a related technical field.
• 1+ years of experience in cybersecurity, helpdesk, technical support, systems administration, or a related technical role.
• Foundational understanding of SIEM, EDR, identity security, endpoint security, and vulnerability management concepts.
• Working knowledge of Windows and Linux fundamentals plus TCP/IP, DNS, HTTP/HTTPS, and common network troubleshooting concepts.
• Basic understanding of Microsoft 365 and identity concepts such as authentication, MFA, account activity, and access events.
• Basic KQL or similar security-query experience with the ability to retrieve and interpret event data.
• Ability to analyze phishing messages, suspicious sign-ins, endpoint alerts, and other common security events using documented procedures.
• Strong written communication, attention to detail, and ticket documentation skills.
• Ability to manage assigned work reliably, recognize when escalation is required, and operate effectively in a team environment.

Preferred Skills and Certifications

• CompTIA Security+ and/or Microsoft Certified: Security Operations Analyst Associate (SC-200), completed or in progress. Experience with ITSM platforms such as Freshservice or ServiceNow.
• Exposure to Microsoft Entra ID, Microsoft Defender, Microsoft Sentinel, Sophos, Tenable, or comparable enterprise security platforms.
• Foundational knowledge of AWS or other cloud environments and cloud security concepts.
• Exposure to PowerShell or Python for security analysis, data handling, or task automation.
• Demonstrated interest in developing toward incident investigation, threat hunting, detection engineering, or cloud security responsibilities.

Success in This Role

Success is demonstrated through accurate triage, disciplined evidence collection, clear ticket documentation, timely escalation, and continued growth toward independent investigation and threat hunting capabilities.