Cyber Security Analyst

Role Overview

This role offers two levels within a Security Operations Center (SOC) team with distinct responsibilities for Level 1 and Level 2 Cyber Security Analysts. The SOC Analyst Level 1 is responsible for monitoring security alerts, initial triage, and escalating confirmed incidents, while the Level 2 Analyst handles in-depth investigation, incident response leadership, and mentoring L1 analysts.

Responsibilities - SOC Analyst Level 1

• Continuously monitor security alerts and events generated by the SIEM system.
• Perform initial triage to classify alerts into true positives, false positives, and prioritize them accordingly.
• Escalate high-priority or confirmed incidents to senior analysts following escalation protocols.
• Accurately document alerts and responses in the case management platform (DFIR-IRIS).
• Execute approved response workflows through the SOAR platform under supervision.
• Augment alerts with basic threat intelligence such as IP/domain/hash reputation analysis.
• Oversee system health via dashboards, including agent and log status.
• Adhere strictly to SOPs and playbooks for common threats like malware, brute force, and policy violations.
• Maintain detailed shift handover logs and communicate ongoing incidents to subsequent shifts.
• Assist senior analysts with refining detection rules and report generation as needed.

Responsibilities - SOC Analyst Level 2

• Conduct detailed incident investigations triggered by escalated L1 alerts, including root cause and impact assessment.
• Demonstrate comprehensive knowledge of networking, operating systems (Windows/Linux), and attack methods.
• Lead and coordinate incident response to contain, eradicate, and recover from threats.
• Integrate data from SIEM, threat intelligence, and case management to construct thorough incident analysis.
• Design and enhance automated SOAR response workflows to streamline operations.
• Engage in proactive threat hunting activities by leveraging current threat intelligence and known tactics.
• Refine SIEM rules to reduce false positives and improve detection fidelity.
• Maintain extensive case documentation including timelines, evidences, and remediation steps.
• Perform malware analysis and forensics when required.
• Review vulnerabilities and security assessments, prioritize fixes alongside system owners.
• Mentor L1 analysts by reviewing triage decisions and providing constructive feedback.
• Prepare comprehensive incident reports and summaries for management review.
• Drive continuous advancements in SOC processes, playbooks, and detection techniques.
• Collaborate closely with IT and infrastructure teams throughout incident mitigation.

Required Qualifications and Skills

• Bachelor’s degree in Computer Science, IT, Cybersecurity, or related discipline, or equivalent professional experience.
• For L1: Up to 2 years of experience in a SOC or IT security role; for L2: 1-2+ years specifically in SOC, incident response, or security analysis.
• Working knowledge of networking concepts including TCP/IP, DNS, HTTP/S, and firewall operations.
• Familiarity with common cyberattack techniques such as phishing, malware, brute force, and basic understanding of the MITRE ATT&CK framework.
• Experience using SIEM tools like Wazuh for log analysis and alert monitoring, including tuning correlation rules (L2).
• Exposure to SOAR platforms (e.g., Shuffle) for automating incident response processes.
• Competence with threat intelligence platforms (like MISP) and applying indicators of compromise and tactics in investigations (L2).
• Proficiency with case management systems (DFIR-IRIS or comparable) for incident documentation.
• Strong communication skills for clear reporting and shift coordination.
• Capability to work rotational shifts, including night and weekend schedules.