SOC L1

Sisainfosec; Bengaluru; On-site; INR 600,000 - 1,200,000; Full time

Job summary

Sisainfosec is seeking a SOC Analyst L1 in Bengaluru to monitor, triage, and perform initial analysis of security events from IBM QRadar and related tools. You will validate incidents, escalate genuine issues, and support ongoing log collection and alerting across teams.

The role requires 2–4 years in SOC or security monitoring, a CS/IT/Cybersecurity degree, and familiarity with the MITRE ATT&CK framework. A shift-based, 24x7 SOC environment is expected.

Qualifications

• Bachelor’s degree in Computer Science, IT, or Cybersecurity.
• 2–4 years of experience in SOC or security monitoring roles.
• Preferred certifications: IBM QRadar Fundamentals, CompTIA Security+, EC-Council CSA, CCNA Security.

Responsibilities

• Monitor, analyze, and triage security events using IBM QRadar and integrated tools.
• Validate true incidents and escalate to L2 analysts as needed.
• Perform initial investigation and categorization of offences by severity and priority.
• Follow SOC processes, SOPs, and playbooks; document incident details.
• Coordinate with infra and security teams to ensure uninterrupted log collection and alerting.

Skills

QRadar

Networking basics

Endpoint security

MITRE ATT&CK

Incident response lifecycle

Communication

Education

Bachelor’s degree in Computer Science/IT/Cybersecurity

Tools

QRadar

ServiceNow

JIRA

SIEM platforms

Job description

The SOC Analyst L1 is responsible for real-time monitoring, triage, and initial analysis of security events and alerts generated from the IBM QRadar SIEM platform and associated security tools. This role focuses on identifying potential threats, validating incidents, and escalating genuine issues for further investigation, ensuring proactive and continuous protection of enterprise systems.

Key Responsibilities

• Monitor, analyze, and triage security events and alerts using IBM QRadar and other integrated tools.
• Identify false positives and validate true security incidents for escalation to L2 analysts.
• Perform initial investigation and categorization of QRadar offenses based on severity and priority.
• Follow defined SOC processes, playbooks, and standard operating procedures (SOPs).
• Document incident details and maintain accurate records in the incident management system (e.g., ServiceNow, JIRA).
• Conduct regular health checks of the QRadar environment – event flow, EPS utilization, and log source connectivity.
• Collaborate with the infrastructure and security teams to ensure uninterrupted log collection and alerting.
• Assist with correlation rule testing and detection use case validation.
• Participate in knowledge sharing, shift handovers, and daily SOC briefings.
• Stay up to date with emerging cyber threats and QRadar enhancements.

Required Technical Skills

• Basic understanding of IBM QRadar SIEM – offense management, event viewer, and log activity.
• Knowledge of networking concepts – TCP/IP, DNS, HTTP/S, SMTP, VPN, Firewalls.
• Familiarity with endpoint security, IDS/IPS, and antivirus solutions.
• Awareness of cyber attack methodologies and the MITRE ATT&CK framework.
• Understanding of the incident response lifecycle (Detection, Analysis, Containment, Recovery).
• Strong analytical, problem-solving, and communication skills.
• Ability to work in a 24x7 rotational shift SOC environment.

Qualifications & Certifications

• Bachelor’s degree in Computer Science, Information Technology, or Cybersecurity.
• 2–4 years of experience in SOC or security monitoring roles.
• Preferred certifications: IBM QRadar Fundamental, CompTIA Security+, EC-Council CSA, CCNA Security.