SOC L1 Cyber Security Analyst

The Level 1 (L1) Cyber Security Analyst is the first line of defense within our 24/7 Security Operations Center (SOC). This role is responsible for the real-time monitoring, analysis, and triage of security alerts to identify and respond to potential cyber threats. The analyst will play a critical role in incident response and initial managed security services, ensuring the continuous security posture of our clients' digital infrastructure.

Continuously monitor security alerts and events from various sources, including SIEM (Security Information and Event Management), EDR (Endpoint Detection and Response), IDS/IPS, and other security tools.

Analyze and triage security alerts to identify potential security incidents, and determine their legitimacy, severity, and potential impact.

Distinguish between false positives and legitimate security threats through initial investigation and log analysis.

Categorize and prioritize security incidents based on established procedures and severity levels.

Serve as the first responder to security incidents, initiating the incident response process according to established playbooks.

Execute initial containment actions, such as isolating affected systems or endpoints, to prevent the spread of threats.

Gather and preserve forensic data and relevant logs for further investigation by higher-tier analysts.

Provide detailed, accurate, and timely documentation of incidents, including a summary of findings and actions taken.

Escalate confirmed incidents and more complex investigations to Level 2 (L2) analysts or senior incident response teams as needed.

Monitor the health and status of security devices and tools, such as firewalls, SIEM, and EDR agents, to ensure they are operating effectively.

Perform initial troubleshooting of security device issues and elevate to appropriate engineering teams when necessary.

Contribute to the tuning and improvement of security monitoring rules and alerts under supervision.

Fully managed security services of client’s customers and ensure Monitoring and Protection of customers against DDoS Attacks. This also includes but not limited to: DDoS protection operation, Software updates, Patching, Health checks, Preventive maintenance and RMA

Work on a 24/7 rotational shift schedule, including nights, weekends, and holidays, to ensure continuous security coverage.

Participate in seamless shift handover processes, providing comprehensive updates to incoming team members.

Collaborate effectively with team members and other IT and security departments to ensure a coordinated response to security events.

Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or a related field, or equivalent experience.

1-3 years of experience in a Security Operations Center (SOC) or a similar cybersecurity role is preferred, with exposure to a Managed Security Service Provider (MSSP) environment being a plus.

CompTIA Security+ or similar fundamental security certifications.

Certified SOC Analyst (CSA) or GIAC Security Essentials (GSEC).

Basic understanding of cybersecurity principles, networking protocols (TCP/IP), and operating systems (Windows, Linux).

Experience with SIEM platforms (e.g., Splunk, QRadar, Microsoft Sentinel, Log Rhythm) for log analysis and monitoring.

Familiarity with incident response procedures and frameworks.

Strong analytical and problem-solving abilities.

Excellent written and verbal communication skills for incident documentation and reporting.

High attention to detail and ability to remain focused during routine monitoring.

Ability to work effectively under pressure and in a fast-paced, 24/7 environment.