SOC Analyst – L1

Alif Consulting; Pune District; On-site; INR 600,000 - 900,000; Full time

Job summary

AlifCloud IT Consulting Pvt. Ltd. is seeking a SOC Analyst – L1 to join our Security Operations Center team in Pune. You will monitor security alerts, conduct initial investigations, and triage incidents using Microsoft Sentinel and KQL in an MSSP environment.

The role requires hands-on experience with Microsoft Sentinel, knowledge of KQL, and a willingness to work in rotational shifts including nights. Prior MSSP exposure and strong incident documentation will be highly valued.

Qualifications

• Hands-on experience with Microsoft Sentinel mandatory.
• Good understanding of KQL and ability to write queries for security investigations.
• Prior MSSP/Managed SOC environment experience required.
• Experience handling and triaging security alerts/incidents.
• Basic understanding of Incident Response and SOC processes.
• Familiarity with SIEM concepts and log analysis.
• Willingness to work in rotational shifts, including night shifts, weekends and public holidays.

Responsibilities

• Monitor security alerts and events using Microsoft Sentinel and other security monitoring tools.
• Perform L1 alert triage and investigate suspicious activities.
• Analyze logs from endpoints, firewalls, network devices, cloud environments, identity systems, and other security sources.
• Write and execute KQL queries for alert investigation, threat hunting, and log analysis.
• Perform initial investigation of security incidents and determine severity, impact, and priority.
• Identify false positives and perform appropriate alert closure with proper documentation.
• Escalate confirmed or complex incidents to L2/L3 / Incident Response teams.
• Have a basic understanding of Incident Response processes, including identification, containment, eradication, and recovery.
• Follow SOC playbooks, escalation procedures, and incident‑handling processes.
• Maintain accurate investigation notes and incident documentation.
• Work with multiple customer environments in an MSSP setup while maintaining SLA requirements.
• Participate in continuous improvement of detection rules, use cases, and SOC processes.
• Stay updated on common attack techniques, vulnerabilities, and threat intelligence.

Skills

Microsoft Sentinel

KQL queries

MSSP / Managed SOC experience

SOC operations

Incident Response basics

SIEM concepts

L1 alert triage

Incident documentation

Analytical thinking

Job description

AlifCloud IT Consulting Pvt. Ltd. | Full time

Shift: Rotational Shifts, including Night Shifts

About the Role

We are looking for a SOC Analyst – L1 to join our Security Operations Center team. The ideal candidate should have hands‑on experience working with Microsoft Sentinel, be comfortable writing KQL queries, and have prior experience in an MSSP/SOC environment.

The candidate will be responsible for continuous security monitoring, initial alert investigation, incident triage, escalation, and supporting the incident response team.

Key Responsibilities

• Monitor security alerts and events using Microsoft Sentinel and other security monitoring tools.
• Perform L1 alert triage and investigate suspicious activities.
• Analyze logs from endpoints, firewalls, network devices, cloud environments, identity systems, and other security sources.
• Write and execute KQL (Kusto Query Language) queries for alert investigation, threat hunting, and log analysis.
• Perform initial investigation of security incidents and determine severity, impact, and priority.
• Identify false positives and perform appropriate alert closure with proper documentation.
• Escalate confirmed or complex incidents to L2/L3 / Incident Response teams.
• Have a basic understanding of Incident Response (IR) processes, including identification, containment, eradication, and recovery.
• Follow SOC playbooks, escalation procedures, and incident‑handling processes.
• Maintain accurate investigation notes and incident documentation.
• Work with multiple customer environments in an MSSP setup while maintaining SLA requirements.
• Participate in continuous improvement of detection rules, use cases, and SOC processes.
• Stay updated on common attack techniques, vulnerabilities, and threat intelligence.

Mandatory Skills & Experience

• 1–3 years of experience in SOC / Cybersecurity Operations.
• Hands‑on experience with Microsoft Sentinel is mandatory.
• Good understanding of KQL and ability to write queries for security investigations.
• Previous experience working in an MSSP / Managed SOC environment is mandatory.
• Experience handling and triaging security alerts/incidents.
• Basic understanding of Incident Response and SOC processes.
• Basic understanding of SIEM concepts and log analysis.
• Understanding of common security threats such as phishing, malware, brute‑force attacks, credential attacks, suspicious PowerShell activity, and unauthorized access.
• Ability to analyze security events and correlate information from multiple log sources.
• Willingness to work in rotational shifts, including night shifts, weekends, and public holidays.
• Good communication and incident documentation skills.

Good to Have

• Experience with Microsoft Defender XDR / Defender for Endpoint / Defender for Identity.
• Knowledge of Azure and Microsoft Entra ID security.
• Experience with EDR/XDR platforms.
• Basic knowledge of network security, firewalls, IDS/IPS, VPN, DNS, and authentication protocols.
• Knowledge of MITRE ATT&CK framework.
• Experience creating or tuning Sentinel analytics rules and detection use cases.
• Relevant certifications such as SC-200, Security+, CEH, or equivalent.

Candidate Profile

• We are looking for someone who:
• Can independently perform L1 alert triage.
• Is comfortable working with Microsoft Sentinel and KQL daily.
• Understands how an MSSP/SOC operates across multiple customers.
• Can differentiate between false positives and genuine security incidents.
• Has a security‑first mindset and strong analytical skills.
• Is comfortable working under SLA‑driven and shift‑based SOC operations.
• Is willing to learn and progress toward an L2 SOC / Incident Response role.