SOC L1 Cyber Security Analyst

Wipro; Doha; On-site; QAR 60,000 - 90,000; Full time

Job summary

Wipro is seeking a Level 1 Cyber Security Analyst to join its 24/7 Security Operations Center in Doha. You will monitor, analyze, and triage security alerts in real time, escalating incidents as needed to protect client environments.

You will work on shift-based coverage, handle initial containment, document findings, and collaborate with L2 teams to strengthen the security posture of diverse clients. Preferred candidates hold a Bachelor's in a relevant field and 1–3 years MSSP experience;

Qualifications

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or related field.
• 1–3 years of experience in a SOC or similar cybersecurity role (MSSP exposure is a plus).
• CompTIA Security+ or CSA/GSEC certifications preferred.

Responsibilities

• Monitor security alerts and events from SIEM, EDR, IDS/IPS, and other tools.
• Analyze and triage alerts to determine legitimacy, severity, and impact.
• Serve as first responder in incident response and initial containment.
• Escalate complex incidents to Level 2 analysts as needed.
• Monitor health of security devices and tune alerts under supervision.
• Work 24/7 shifts and collaborate across IT/security teams.

Skills

SOC operations

Incident analysis

Analytical thinking

Communication skills

Windows & Linux basics

TCP/IP networking

Education

Bachelor's degree in Cybersecurity/CS/IT

Tools

SIEM (Splunk)

EDR tools

QRadar

Microsoft Sentinel

LogRhythm

Job description

The Level 1 (L1) Cyber Security Analyst is the first line of defense within our 24/7 Security Operations Center (SOC). This role is responsible for the real-time monitoring, analysis, and triage of security alerts to identify and respond to potential cyber threats. The analyst will play a critical role in incident response and initial managed security services, ensuring the continuous security posture of our clients' digital infrastructure.

Key Responsibilities

1. Security Monitoring and Triage

Continuously monitor security alerts and events from various sources, including SIEM (Security Information and Event Management), EDR (Endpoint Detection and Response), IDS/IPS, and other security tools.

Analyze and triage security alerts to identify potential security incidents, and determine their legitimacy, severity, and potential impact.

Distinguish between false positives and legitimate security threats through initial investigation and log analysis.

Categorize and prioritize security incidents based on established procedures and severity levels.

2. Incident Response and Initial Containment

Serve as the first responder to security incidents, initiating the incident response process according to established playbooks.

Execute initial containment actions, such as isolating affected systems or endpoints, to prevent the spread of threats.

Gather and preserve forensic data and relevant logs for further investigation by higher-tier analysts.

Provide detailed, accurate, and timely documentation of incidents, including a summary of findings and actions taken.

Escalate confirmed incidents and more complex investigations to Level 2 (L2) analysts or senior incident response teams as needed.

3. Managed Security Services and Device Health

Monitor the health and status of security devices and tools, such as firewalls, SIEM, and EDR agents, to ensure they are operating effectively.

Perform initial troubleshooting of security device issues and elevate to appropriate engineering teams when necessary.

Contribute to the tuning and improvement of security monitoring rules and alerts under supervision.

Fully managed security services of client’s customers and ensure Monitoring and Protection of customers against DDoS Attacks. This also includes but not limited to: DDoS protection operation, Software updates, Patching, Health checks, Preventive maintenance and RMA

4. Shift Operations and Collaboration

Work on a 24/7 rotational shift schedule, including nights, weekends, and holidays, to ensure continuous security coverage.

Participate in seamless shift handover processes, providing comprehensive updates to incoming team members.

Collaborate effectively with team members and other IT and security departments to ensure a coordinated response to security events.

Required Skills and Qualifications

Education:

Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or a related field, or equivalent experience.

Experience:

1-3 years of experience in a Security Operations Center (SOC) or a similar cybersecurity role is preferred, with exposure to a Managed Security Service Provider (MSSP) environment being a plus.

Certifications (Preferred):

CompTIA Security+ or similar fundamental security certifications.

Certified SOC Analyst (CSA) or GIAC Security Essentials (GSEC).

Technical Skills:

Basic understanding of cybersecurity principles, networking protocols (TCP/IP), and operating systems (Windows, Linux).

Experience with SIEM platforms (e.g., Splunk, QRadar, Microsoft Sentinel, LogRhythm) for log analysis and monitoring.

Familiarity with incident response procedures and frameworks.

Soft Skills:

Strong analytical and problem-solving abilities.

Excellent written and verbal communication skills for incident documentation and reporting.

High attention to detail and ability to remain focused during routine monitoring.

Ability to work effectively under pressure and in a fast-paced, 24/7 environment.