Security Operations / SOC Analyst

Key Responsibilities Monitor and investigate security alerts and incidents.

Analyse security events using SIEM, EDR/XDR, identity, email, cloud and network tools.

Investigate system logs, authentication activity, processes, DNS, proxy and email activity.

Handle escalated security investigations and determine the appropriate response.

Perform approved incident containment actions such as host isolation and account disablement.

Support incident response, evidence collection and recovery activities.

Develop and improve security detection rules using KQL, SPL, ES|QL, EQL or similar tools.

Identify and reduce false positives through detection tuning.

Participate in threat hunting and apply threat intelligence to investigations.

Maintain security runbooks, playbooks and investigation records.

Track remediation actions and verify that security issues have been resolved.

Prepare investigation updates and contribute to security reports.

Work closely with NOC, engineering and client teams during security incidents.

Participate in the rotating after-hours on-call roster.

Support continuous improvement, knowledge sharing and client onboarding activities.

Requirements 3-5 years of experience in SOC, security operations or MDR environments.

Experience handling Level 2 or escalated security investigations.

Hands-on experience with at least one SIEM platform such as Splunk, Microsoft Sentinel, Elastic, QRadar or FortiSIEM.

Experience with an EDR/XDR platform such as CrowdStrike, SentinelOne, Microsoft Defender or Cortex XDR.

Working knowledge of KQL, SPL, ES|QL, EQL or similar query languages.

Familiarity with Sigma and MITRE ATT&CK.

Good understanding of Windows, Linux, Active Directory and Microsoft 365/Azure security.

Good knowledge of TCP/IP, DNS, HTTP/TLS, firewalls, proxies and VPNs.

Experience using ITSM platforms such as ServiceNow or Jira Service Management.

EA Number: 11C4879