SOC Analyst

Accenture PLC; Kuwait City; On-site; KWD 19,000 - 28,000; Full time

Job summary

Accenture PLC is seeking a SOC Analyst (L1/L2) to monitor and respond to cybersecurity threats across enterprise environments in a 24x7 SOC setup. You will triage alerts, investigate incidents, and coordinate with stakeholders to ensure timely remediation.

The role requires strong SIEM/SOAR experience, incident handling, and collaboration across teams. The successful candidate will work in Kuwait City and contribute to continuous improvement in detection, logging, and case handling processes

Qualifications

• 1-3 years of experience in Security Operations, IT security, or a related role.
• Bachelor’s degree in computer science or related field.
• Hands-on exposure to SIEM, SOAR, EDR, or monitoring tools.
• Knowledge of threat types and MITRE ATT&CK framework.
• Strong analytical and problem-solving skills.

Responsibilities

• Monitor and analyze security alerts from SIEM, SOAR, EDR, and other tools.
• Triage, validate, and investigate alerts per SLA and priority matrix.
• Execute containment and remediation using SOC runbooks.
• Manage incidents through full lifecycle with documentation.
• Coordinate with stakeholders and ensure timely responses.
• Perform shift-based operations and handovers with context.
• Identify gaps in detection, logging, and processes for improvement.

Skills

Threat detection

Incident response

SIEM/SOAR

Endpoint protection

Networking basics

Cloud security

MITRE ATT&CK

Documentation

Communication

Analytical skills

Education

Bachelor's degree in CS/IS/IT

Tools

SIEM

SOAR

EDR

Firewalls

Job description

The SOC Analyst (L1/L2) is responsible for continuous monitoring, detection, analysis, and response to cybersecurity threats across enterprise environments. The role supports 24x7 SOC operations, performing real-time security event monitoring, incident triage, investigation, escalation, and remediation in accordance with established runbooks, SLAs, and client requirements.

Key Responsibilities

• Monitor and analyze security alerts from SIEM, SOAR, EDR, and other security tools to identify potential threats.
• Perform timely triage, validation, and investigation of alerts in accordance with SLA and prioritization matrix (P1-P4).
• Execute approved containment, response, and remediation actions using defined SOC runbooks.
• Manage incidents through the full case lifecycle, ensuring accurate documentation, status updates, and closure in the case management system.
• Follow standard case handling processes, including case stage/status flow and QA validation requirements.
• Monitor SOC communication channels (e.g., mailbox, SOAR) and ensure timely response to inquiries, escalations, and stakeholder coordination.
• Escalate high-severity or complex incidents in line with SLAs, including immediate notification for potential P1/P2 cases.
• Ensure SLA compliance and resolution, including coordination with internal and external stakeholders.
• Perform shift-based operations, including effective handover of active and critical cases with complete context.
• Identify and report operational issues, anomalies, or delays within the same shift to relevant leads.
• Support continuous improvement by supporting in identifying gaps in detection, logging, automation, and case handling processes.

Technical Skills

• Strong understanding of cybersecurity fundamentals, including threat types, attack vectors, the CIA triad, and awareness of frameworks such as MITRE ATT&CK for threat identification.
• Working knowledge of operating systems (Windows, Linux/Unix) and networking concepts (TCP/IP, OSI model, DNS, HTTP/S).
• Experience or familiarity with SIEM/SOAR platforms, endpoint protection, firewalls, and security monitoring tools.
• Ability to analyze logs, network traffic, and endpoint telemetry to identify malicious activity.
• Exposure to cloud security concepts (Azure, AWS, or GCP) is an advantage.
• Familiarity with the MITRE ATT&CK framework for threat identification is an advantage.
• Bachelor’s degree in computer science, Information Security, Information Technology, or a related field.
• 1-3 years of experience in Security Operations, IT security, or a related role.
• Basic understanding of cybersecurity concepts, threats, and attack methodologies.
• Hands-on exposure or academic experience with SIEM, SOAR, EDR, or security monitoring tools is an advantage.
• Familiarity with incident handling, alert triage, and case management processes.
• Strong analytical and problem-solving skills with attention to detail.
• Good written and verbal communication skills for documentation and handover reporting.
• Relevant certifications - e.g., Security+, SC-200, CEH (Associate level) - are an advantage but not mandatory.