Security Operations Center (SOC) Analyst I
Location: Bangalore, India
Department: Cybersecurity Operations Center (CSOC)
Employment Type: Full-Time Work Arrangement: Bangalore-based; remote/hybrid options negotiable after onboarding
Role focus: Monitor, validate, triage, document, and escalate. Build strong investigation fundamentals while operating within established CSOC procedures.
Job Summary
The Security Operations Center (SOC) Analyst I is an entry-level cybersecurity role responsible for monitoring, validating, and triaging security alerts across endpoint, identity, email, network, vulnerability, and cloud security telemetry. The analyst performs initial investigation, documents evidence, follows established CSOC playbooks, and escalates events that require deeper analysis or response. This role is designed for early-career security professionals who want to build strong foundations in security operations, incident response, and threat detection in a global enterprise environment.
Key Responsibilities
• Monitor and triage alerts from SIEM, EDR, identity, email security, vulnerability management, and cloud security platforms.
• Perform initial analysis using platforms such as Microsoft Sentinel, Microsoft Defender, Sophos, Tenable, and equivalent enterprise security tools.
• Validate alert context, identify affected users and assets, gather relevant evidence, establish an initial timeline, and categorize or escalate events according to CSOC procedures.
• Investigate common SOC scenarios including phishing, suspicious authentication, endpoint alerts, user-reported security events, and endpoint health issues.
• Use basic KQL and approved search or hunting capabilities to retrieve and correlate security telemetry.
• Create and maintain clear security tickets that capture evidence, actions taken, current state, escalation rationale, and next steps.
• Support vulnerability tracking, remediation follow-up, and validation of security findings.
• Preserve investigation evidence and follow Alvaria data handling and security requirements throughout the investigation lifecycle.
• Collaborate with global security, IT, identity, endpoint, cloud, and infrastructure teams when additional investigation or remediation is required.
• Follow established SOPs and playbooks and contribute updates to knowledge articles as recurring investigation patterns are identified.
Required Qualifications
• Bachelor's degree in Cybersecurity, Information Security, Computer Science, Information Technology, or a related technical field.
• 1+ years of experience in cybersecurity, helpdesk, technical support, systems administration, or a related technical role.
• Foundational understanding of SIEM, EDR, identity security, endpoint security, and vulnerability management concepts.
• Working knowledge of Windows and Linux fundamentals plus TCP/IP, DNS, HTTP/HTTPS, and common network troubleshooting concepts.
• Basic understanding of Microsoft 365 and identity concepts such as authentication, MFA, account activity, and access events.
• Basic KQL or similar security-query experience with the ability to retrieve and interpret event data.
• Ability to analyze phishing messages, suspicious sign-ins, endpoint alerts, and other common security events using documented procedures.
• Strong written communication, attention to detail, and ticket documentation skills.
• Ability to manage assigned work reliably, recognize when escalation is required, and operate effectively in a team environment.
Preferred Skills and Certifications
• CompTIA Security+ and/or Microsoft Certified: Security Operations Analyst Associate (SC-200), completed or in progress. • Experience with ITSM platforms such as Freshservice or ServiceNow.
• Exposure to Microsoft Entra ID, Microsoft Defender, Microsoft Sentinel, Sophos, Tenable, or comparable enterprise security platforms.
• Foundational knowledge of AWS or other cloud environments and cloud security concepts.
• Exposure to PowerShell or Python for security analysis, data handling, or task automation.
• Demonstrated interest in developing toward incident investigation, threat hunting, detection engineering, or cloud security responsibilities.
Success in This Role
Success is demonstrated through accurate triage, disciplined evidence collection, clear ticket documentation, timely escalation, and continued growth toward independent investigation and threat hunting capabilities.
