SOC Analyst (L1.5)

Zensar; Hyderabad; On-site; INR 600,000 - 900,000; Full time

Job summary

Zensar in Hyderabad is seeking a SOC Analyst (L1.5) with hands-on experience in security operations, monitoring, incident response, threat hunting, and SIEM technologies. The candidate should have exposure to Logpoint SIEM and strong experience handling security incidents, alert triage, and threat investigations in a 24x7 SOC environment.

Ideal candidates will have exposure to Microsoft Sentinel, Splunk, QRadar, or ArcSight, along with incident response and threat hunting capabilities.

Qualifications

• Bachelor's degree or equivalent in CS/IT/Cyber Security or related field.
• 3+ years of SOC Operations experience in a 24x7 environment.
• Experience with incident response, alert triage and threat hunting.
• Strong analytical and troubleshooting skills.

Responsibilities

• Monitor security alerts from SIEMs and security tools.
• Triages real-time alerts and validates incidents.
• Investigates malware, phishing, ransomware, insider threats and unauthorized access.
• Escalates incidents to L2/L3 as per processes.
• Maintains SIEM dashboards, reports and tuning.

Skills

Logpoint SIEM

Microsoft Sentinel

Splunk

IBM QRadar

ArcSight

Microsoft Defender

CrowdStrike

SentinelOne

Palo Alto

Fortinet

IDS/IPS

Email Security

Education

Bachelor's Degree in Computer Science, Information Technology, Cyber Security, or related field

3+ years SOC Operations experience

Tools

Logpoint SIEM

Microsoft Sentinel

Splunk

IBM QRadar

ArcSight

Job description

Job Summary

We are looking for a SOC Analyst (L1.5) with hands-on experience in Security Operations, Security Monitoring, Incident Response, Threat Hunting, and SIEM technologies. The ideal candidate should have exposure to Logpoint SIEM and strong experience in handling security incidents, alert triage, and threat investigations in a 24x7 SOC environment.

Candidates with strong experience in Microsoft Sentinel, Splunk, QRadar, or ArcSight along with incident response and threat hunting capabilities will also be considered.

Key Responsibilities

Security Monitoring & Incident Detection

• Monitor and analyze security alerts generated from SIEM and integrated security tools.
• Perform real-time alert triage and validate security incidents.
• Investigate incidents related to malware, phishing, ransomware, insider threats, account compromise, privilege misuse, and unauthorized access.
• Escalate incidents to L2/L3 teams as per defined processes.
• Ensure adherence to incident response SLAs and SOC procedures.

Incident Response & Investigation

• Perform incident investigation and root cause analysis.
• Analyze logs from:
  • Windows Servers & Workstations
  • Linux Systems
  • Active Directory
  • Firewalls
  • IDS/IPS
  • EDR/XDR Solutions
  • Proxy & Email Security Platforms
  • Cloud Platforms (Azure, AWS, GCP)
• Support containment, eradication, recovery, and remediation activities.
• Document incidents, findings, and recommendations.

Threat Hunting & Threat Intelligence

• Perform proactive threat hunting activities.
• Utilize MITRE ATT&CK Framework for threat mapping and analysis.
• Analyze Indicators of Compromise (IOC) and Indicators of Attack (IOA).
• Correlate threat intelligence with internal security events.
• Identify suspicious user and system behavior.

SIEM Operations

• Monitor and manage Logpoint SIEM use cases and alerts.
• Support correlation rule tuning and alert optimization.
• Create and maintain dashboards, reports, and custom searches.
• Validate log ingestion and monitor SIEM health.
• Reduce false positives through continuous tuning activities.

Required Technical Skills SIEM Technologies

• Logpoint SIEM (Preferred)
• Microsoft Sentinel
• Splunk
• IBM QRadar
• ArcSight

Security Technologies

• Microsoft Defender
• CrowdStrike
• SentinelOne
• Palo Alto
• Fortinet
• Check Point
• Cisco Security Solutions
• IDS/IPS
• Email Security Solutions

Threat & Security Operations

• Security Monitoring
• Incident Response
• Alert Triage
• Incident Investigation
• Threat Hunting
• Threat Intelligence
• Malware Analysis
• Phishing Investigation
• Event Correlation
• Root Cause Analysis

Operating Systems & Networking

• Windows Administration
• Linux Administration
• TCP/IP
• DNS
• DHCP
• VPN
• HTTP/HTTPS
• SMTP
• Network Security Concepts

Security Frameworks

• MITRE ATT&CK
• Cyber Kill Chain
• NIST Incident Response Lifecycle
• Threat Intelligence Concepts

Qualifications

• Bachelor's Degree in Computer Science, Information Technology, Cyber Security, or related field.
• 3+ years of SOC Operations experience.
• Experience working in a 24x7 SOC environment.
• Strong analytical and troubleshooting skills.
• Good verbal and written communication skills.

Preferred Certifications

• SC-200 (Microsoft Security Operations Analyst)
• CEH
• CompTIA Security+
• Logpoint Certified Analyst
• Splunk Certifications

Ideal Candidate

• 3-6 years of SOC experience.
• Hands-on exposure to Logpoint SIEM is highly desirable.
• Strong experience with Microsoft Sentinel, Splunk, QRadar, or ArcSight.
• Experience in Incident Response, Alert Triage, Threat Hunting, Security Monitoring, and Threat Intelligence.
• Exposure to CrowdStrike, Defender, SentinelOne, Palo Alto, or Fortinet.
• Willingness to work from Hyderabad in 24x7 rotational shifts.

Key Responsibilities

Security Monitoring & Incident Detection

• Monitor and analyze security alerts generated from SIEM and integrated security tools.
• Perform real-time alert triage and validate security incidents.
• Investigate incidents related to malware, phishing, ransomware, insider threats, account compromise, privilege misuse, and unauthorized access.
• Escalate incidents to L2/L3 teams as per defined processes.
• Ensure adherence to incident response SLAs and SOC procedures.

Incident Response & Investigation

• Perform incident investigation and root cause analysis.
• Analyze logs from:
  • Windows Servers & Workstations
  • Linux Systems
  • Active Directory
  • Firewalls
  • IDS/IPS
  • EDR/XDR Solutions
  • Proxy & Email Security Platforms
  • Cloud Platforms (Azure, AWS, GCP)
• Support containment, eradication, recovery, and remediation activities.
• Document incidents, findings, and recommendations.

Threat Hunting & Threat Intelligence

• Perform proactive threat hunting activities.
• Utilize MITRE ATT&CK Framework for threat mapping and analysis.
• Analyze Indicators of Compromise (IOC) and Indicators of Attack (IOA).
• Correlate threat intelligence with internal security events.
• Identify suspicious user and system behavior.

SIEM Operations

• Monitor and manage Logpoint SIEM use cases and alerts.
• Support correlation rule tuning and alert optimization.
• Create and maintain dashboards, reports, and custom searches.
• Validate log ingestion and monitor SIEM health.
• Reduce false positives through continuous tuning activities.

At Zensar, we’re

“experience-led everything”

We are committed to conceptualizing, designing, engineering, marketing, and managing digital solutions and experiences for over 130 leading enterprises.

We are a company driven by a bold purpose:

Together, we shape experiences for better futures

Whether for our clients, our people, or the world around us, this belief powers everything we do. At the heart of our culture is

ONE with Client - a set of four core values that reflect who we are and how we work: One Zensar, Nurturing, Empowering, and Client Focus.

Part of the $4.8 billion RPG Group, we’re a community of 10,000+ innovators across 30+ global locations, including Milpitas, Seattle, Princeton, Cape Town, London, Zurich, Singapore, and Mexico City. Explore Life at Zensar and join us to Grow. Own. Achieve. Learn. to be the best version of yourself.

We believe the best work happens when individuality is celebrated, growth is encouraged, and well-being is prioritized.

We are an equal employment opportunity (EEO) and affirmative action employer, committed to creating an inclusive workplace. All qualified applicants will be considered without regard to race, creed, color, ancestry, religion, sex, national origin, citizenship, age, sexual orientation, gender identity, disability, marital status, family medical leave status, or protected veteran status.