About This Role
This role is for a skilled and proactive Senior SOC Operations Analyst to join a cybersecurity operations team. The ideal candidate will bring in-depth experience in working with SIEM and XDR tools, incident response processes, and phishing analysis. The role focuses on monitoring, detecting, analyzing, and responding to cybersecurity incidents, with an emphasis on threat detection, automation, and continuous improvement of SOC operations.
Responsibilities
- Monitor, investigate, and analyze logs and alerts generated by SIEM tools such as Microsoft Sentinel, Splunk, and LogRhythm
- Perform log correlation and filtering to identify malicious patterns and reduce false positives
- Understand and modify existing correlation rules and develop use cases to detect anomalies and security events
- Analyze various log sources including Windows Event Logs, Firewall, Proxy, VPN, DNS, and other security infrastructure logs
- Utilize Extended Detection and Response (XDR) platforms such as Trend Micro Vision One, CrowdStrike Falcon, and Microsoft Defender for Endpoint
- Conduct endpoint investigations, analyze process behavior, service activity, and network connections
- Block known Indicators of Compromise (IOCs), investigate suspicious behavior, and recommend containment actions
- Monitor for lateral movement, persistence techniques, and privilege escalations
- Triage alerts by categorizing and prioritizing incidents (malware, unauthorized access, data leakage, etc.)
- Respond to security incidents and determine scope, impact, severity, and root cause
- Document incident findings and escalate to appropriate stakeholders per defined processes and SLAs
- Collaborate with other IT and security teams for containment, eradication, and recovery
- Analyze suspected phishing/spam emails including header analysis, embedded links, attachments, and URLs
- Perform domain/IP reputation checks using threat intelligence platforms
- Work closely with email administrators and security teams to block malicious senders and educate users
- Use open-source tools and threat intelligence feeds to validate IOCs and assess their impact
- Identify vulnerabilities and suspicious behavior related to malware, fileless attacks, or command execution
- Maintain awareness of evolving threat actor techniques and indicators
- Detect and review suspicious scripts for embedded commands, credential theft, and persistence mechanisms
- Identify common scripting languages used in attacks (PowerShell, Bash, Python)
- Contribute to playbook development and automation initiatives within the SOC
- Understand IP addressing, port protocols (TCP/UDP), DNS, HTTP/HTTPS, and VPN tunnels
