About the role
Monitor enterprise IT infrastructure, applications, cloud platforms, and network environments for cybersecurity threats and suspicious activities. Perform continuous monitoring using Security Information and Event Management (SIEM) tools. Investigate security alerts, events, incidents, and anomalies generated by security monitoring platforms. Conduct initial triage, analysis, categorization, and escalation of security incidents. Monitor and analyze: Network Security Events Endpoint Security Alerts Firewall Logs IDS/IPS Alerts Email Security Events Cloud Security Alerts User Activity Logs Malware Events Authentication Logs Identify indicators of compromise (IOC) and indicators of attack (IOA). Perform threat detection, threat hunting, and security event correlation activities. Support cybersecurity incident response activities including containment, eradication, and recovery. Investigate phishing, malware, ransomware, and unauthorized access incidents. Create and maintain incident records, investigation reports, and security dashboards. Monitor compliance with cybersecurity policies and security controls. Escalate critical incidents according to incident management procedures. Support vulnerability management activities by tracking and reporting identified risks. Maintain awareness of emerging cyber threats, vulnerabilities, and attack techniques. Participate in cybersecurity drills, tabletop exercises, and incident simulations. Support audit, compliance, and regulatory security requirements.