About the role
Job Description Must Have Skills & Experience Experience performing full investigations of security s, beyond initial triage Ability to act as the first reviewer of the SOC use case / queue Strong skills in validating s and independently closing s when no security issue is identified Hands on experience investigating logs from SIEM, EDR, network, firewall, email, and endpoint sources Solid understanding of the incident response lifecycle and attacker TTPs Experience working with escalations from L1 and deciding when escalation to L3 or customer is required Clear documentation of investigation findings and closure rationale in ticketing systems Ability to work within defined SLAs in a 24x7 SOC environment Good to Have Skills Experience with SIEM platforms such as Splunk or Microsoft Sentinel Exposure to threat intelligence, IOC enrichment, or basic threat hunting Ability to suggest tuning or detection improvements based on investigation outcomes Experience mentoring or providing feedback to L1 analysts Familiarity with SOC playbooks, runbooks, and standard operating procedures