Security Operations Center Analyst L1

We are seeking a proactive and detail-oriented SOC Analyst – L1 to join our Security Operations Center. The analyst will be responsible for real-time monitoring, detection, and initial triage of security incidents using IBM QRadar SIEM platform in a multi-tenancy environment. This role serves as the front line of defence, identifying suspicious activities and escalating potential threats to L2 Analysts for further investigation.

Key Responsibilities:
• Monitor and analyze security alerts from QRadar SIEM for multiple customers in a multi-tenant SOC environment.
• Perform initial triage and prioritization of security events and incidents.
• Investigate basic security incidents such as malware detections, brute-force attempts, unauthorized access, and phishing attempts.
• Accurately document incidents, actions taken, and escalation steps in the ticketing system.
• Follow defined Standard Operating Procedures (SOPs) for incident classification, prioritization, and escalation.
• Assist in threat intelligence correlation and trend identification across tenants.
• Regularly communicate with L2/L3 analysts for escalations and further analysis.
• Stay updated on common vulnerabilities and attack patterns (CVEs, IOC, MITRE ATTCK, etc.).

Required Skills Qualifications:
• 1 – 4 years of experience in SOC operations or a cybersecurity role.
• Hands-on experience with IBM QRadar /any SIEM Tool (log monitoring, offenses, rule-based alerts).
• Basic understanding of cybersecurity concepts like firewalls, IDS/IPS, malware, phishing, brute force, etc.
• Knowledge of TCP/IP, ports and protocols, OSI model.
• Experience working in a multi-tenancy SOC setup is a plus.
• Good communication skills and ability to work under pressure in shift-based operations.
• Familiarity with ticketing tools (like ServiceNow, Tussom, etc.).
• Willingness to work in 24x7 rotational shifts.

Preferred Certifications (any one):
• IBM QRadar Certified Associate
• CompTIA Security+
• CEH (Certified Ethical Hacker)
• Any SIEM or SOC-related certification Read more