Level 1 Security Operations Center; SOC Analyst

B. Online is seeking a motivated “
Level 1 Security Operations Center (SOC) Analyst
” with 3 years of hands‑on experience to join our growing cybersecurity team. In this role you will monitor security alerts, triage incidents, and work with our Fortinet‑based SIEM and SOAR tools to ensure the protection of our network and data assets. You’ll be the first line of defense—analyzing alerts, escalating critical events, and contributing to the refinement of our security playbooks.

• 24×7 Monitoring & Alert Triage.
• Monitor security events and alerts via FortiSIEM and FortiSOAR dashboards.
• Perform initial triage: validate, classify, and prioritize incidents.
• Execute predefined playbooks in Fortinet SOAR for containment and remediation.
• Escalate escalated incidents to Level 2/3 teams with clear documentation.
• Correlate logs from firewalls, endpoints, and servers to identify patterns.
• Enrich alerts with threat‑intel feeds and contextual data.
• Assist in the development and tuning of detection rules in FortiSIEM
• Contribute to SOAR automation scripts and workflows to reduce manual effort
• Maintain accurate incident reports, post‑mortem summaries, and metrics dashboards
• Provide daily/weekly status updates to SOC lead and stakeholders

• Minimum of 3 years in a SOC or similar security operations role.
• Hands‑on with Fortinet SIEM (FortiSIEM) and SOAR (FortiSOAR) platforms.
• Familiarity with firewall, IDS/IPS, endpoint, and network log analysis.
• Basic scripting or query skills (Python, SQL, or SOAR playbook scripting).
• Certifications (preferred):
  Fortinet NSE 4 or higher, CompTIA Security+ or equivalent.
• Strong analytical and problem‑solving mindset.
• Excellent written and verbal communication.
• Ability to work shift rotations, including nights and weekends.

• Exposure to other SIEM/SOAR tools (Splunk, IBM QRadar, Palo Alto Cortex XSOAR).
• Exposure to other XDR, EDR tools (Bitdefender, Forti Client, Crowedstrike ..etc).
• Understanding of MITRE ATT&CK framework and IOC/TTP analysis.
• Experience with cloud‑based log collection (AWS Cloud Watch, Azure Monitor).
• Prior involvement in threat hunting or purple‑team exercises.

You may also apply via