Requirements
Monitor, analyze, investigate, and respond to cybersecurity events and incidents. Investigate security alerts, perform threat hunting, analyze malware and phishing attempts. Document investigations and support forensic investigations. Maintain SOC operational documentation and coordinate with IT teams. Monitor compliance with SOC operational procedures and SLAs. Participate in vulnerability and threat management. Prepare operational reports and stay updated on emerging cyber threats.
Description
Purpose:To monitor, analyze, investigate, and respond to cybersecurity events and incidents, ensuring timely detection, containment, and escalation of security threats while maintaining continuous security monitoring operations.Main Duties and Responsibilities:Monitor security events generated by SIEM, EDR, IDS/IPS, firewalls, and other security technologies.Investigate security alerts to determine validity, severity, and potential business impact.Respond to cybersecurity incidents in accordance with established incident response procedures.Escalate complex security incidents to senior cybersecurity personnel when appropriate.Perform threat hunting activities to proactively identify suspicious behavior.Analyze malware, phishing attempts, and suspicious activities affecting the organization.Document investigations, response activities, and lessons learned.Support forensic investigations by collecting and preserving digital evidence.Maintain SOC operational documentation, playbooks, and incident records.Coordinate with IT teams during containment and recovery activities.Monitor compliance with SOC operational procedures and SLAs.Participate in vulnerability and threat management activities as required.Prepare operational reports and security metrics for management review.Stay updated on emerging cyber threats and attack techniques.Support continuous improvement initiatives within SOC operations.