SOC Analyst

About This Role

This SOC Analyst role focuses on proactively detecting and investigating threats using an NDR platform. You will analyze NetFlow and network traffic, run hypothesis-driven hunts, and carry out network forensics on suspicious activity.

Responsibilities

• Conduct proactive threat hunts on the NDR platform, mapped to MITRE ATT&CK
• Analyze NetFlow, IPFIX, and sFlow data to detect beaconing, lateral movement, data exfiltration, and C2 activity
• Perform deep packet analysis and network forensics using PCAP, Wireshark, and Zeek
• Investigate NDR alerts, validate true positives, and reduce false positives
• Reconstruct attack timelines and prepare forensic and incident reports
• Build and tune detection use cases and traffic baselines
• Integrate NDR findings with the SIEM (ArcSight, Splunk, QRadar, or similar) and support incident response
• Recommend containment and remediation actions

Requirements

• Hands-on experience with an NDR platform (Darktrace, Vectra, ExtraHop, Corelight, Cisco Secure Network Analytics, or similar)
• Strong knowledge of NetFlow/IPFIX analysis and network protocols (TCP/IP, DNS, HTTP/S, SMB, etc.)
• Network forensics and packet analysis (Wireshark, tshark, Zeek, Suricata, Arkime)
• Working knowledge of MITRE ATT&CK, IOCs, and TTPs
• Experience with a SIEM tool; ArcSight is a plus
• Understanding of incident response and DFIR processes