SOC Analyst Intern

R360 Group; Bengaluru; On-site; INR 257,000 - 424,000; Full time

Job summary

R360 Group is building an in-house SOC in Bengaluru to deliver 24x7 monitoring for BFSI platforms supporting major banks. This internship provides mentored exposure to CrowdStrike Falcon and SentinelOne Singularity within a regulated environment.

You will shadow senior analysts, perform L1 triage, contribute to incident investigations, and help document SOPs and new detection use cases, with some night/weekend shifts as part of SOC exposure.

Qualifications

• Assist with L1 alert monitoring and triage in a live SOC
• Map detections to MITRE ATT&CK framework to classify alert severity
• Support SOC handover docs and ticket logging in Jira
• Assist in evidence collection during incident investigations
• Learn log correlation across SIEM, WAF, and CloudTrail data sources
• Participate in SOC playbook walkthroughs and tabletop exercises
• Document SOPs and new detection use cases
• Progressively handle low-severity alerts with senior review before closure

Responsibilities

• Assist with L1 alert monitoring and triage across CrowdStrike Falcon and SentinelOne Singularity dashboards
• Learn to map detections against the MITRE ATT&CK framework to classify alert severity and intent
• Support shift handover documentation and SOC ticket logging in Jira
• Assist senior analysts with evidence collection during incident investigations
• Learn foundational log correlation across SIEM, WAF, and CloudTrail data sources
• Participate in SOC playbook walkthroughs and incident-response tabletop exercises
• Help document standard operating procedures (SOPs) and new detection use cases
• Progressively take ownership of low-severity alert closure, with mandatory senior-analyst review before closure

Skills

L1 monitoring

MITRE ATT&CK

CrowdStrike Falcon

SentinelOne Singularity

Jira

SOC playbooks

Incident investigations

Log correlation

Networking basics

Tools

CrowdStrike Falcon

SentinelOne Singularity

SIEM

WAF

CloudTrail

Job description

R360 is building a dedicated in-house Security Operations Center (SOC) to deliver 24x7 monitoring for its bankinglinked platforms serving HDFC Bank, ICICI Bank, and Kotak Mahindra Bank. This internship gives you structured, mentored exposure to enterprise EDR/XDR tooling CrowdStrike Falcon and SentinelOne Singularity — inside a live, regulated BFSI environment. It's a rare early-career opportunity to build real SOC muscle memory rather than lab simulations, under the direct supervision of senior analystss.

Key Responsibilities (Under Supervision)

• Assist with L1 alert monitoring and triage across CrowdStrike Falcon and SentinelOne Singularity dashboards.
• Learn to map detections against the MITRE ATT&CK framework to classify alert severity and intent.
• Support shift handover documentation and SOC ticket logging in Jira.
• Assist senior analysts with evidence collection during incident investigations.
• Learn foundational log correlation across SIEM, WAF, and CloudTrail data sources.
• Participate in SOC playbook walkthroughs and incident-response tabletop exercises.
• Help document standard operating procedures (SOPs) and new detection use cases.
• Progressively take ownership of low-severity alert closure, with mandatory senior-analyst review before closure.

Learning Outcomes

• Hands-on operational experience with two industry-leading EDR/XDR platforms.
• Exposure to real BFSI incident-response workflows and their regulatory context (PCI DSS v4.0.1, RBI Cyber Security Framework).
• Foundational SOC analyst skills that map directly to L1/L2 career progression.
• Graduate with any background.
• Basic understanding of networking fundamentals (TCP/IP, DNS), operating systems (Windows/Linux), and core security concepts.
• Self-driven learners with prior exposure to CTF platforms (TryHackMe, HackTheBox) are strongly preferred.
• Willingness to work in shifts, including some night/weekend rotations, as part of SOC exposure.

Preferred

• A personal CTF/lab track record — TryHackMe or HackTheBox profile link is welcomed with the application.

1. Month 1–2Foundations

• SOC fundamentals orientation; guided walkthroughs of CrowdStrike Falcon and SentinelOne Singularity; shadowing L1 analysts on live alerts.

2. Month 3–4Guided Triage

• Hands-on alert triage with mandatory senior review; MITRE ATT&CK practice drills; introduction to SIEM correlation basics.
• Independent handling of low-severity alerts (reviewed before closure); capstone project — build one detection use case or SOC playbook end to end.

4. Conversion

• Performance evaluated against triage accuracy, escalation judgment, documentation quality, and shift reliability; strong performers are considered for full-time SOC Analyst conversion.