Security Analyst, CSOC

Accountabilities: Monitor and analyze network traffic, security events, alerts, and threat indicators, recommending appropriate remediation and escalation actions. Investigate security incidents and intrusion attempts by correlating information from multiple sources to determine affected systems, applications, or data. Analyze logs from SIEM, EDR, firewalls, proxies, NIDS, HIDS, and host systems to identify malicious activity and establish appropriate response paths. Independently identify, classify, contain, investigate, document, and eradicate security threats in accordance with established procedures. Perform L1 security event and incident analysis, identify false positives, correlate related events, and escalate confirmed or high-risk incidents appropriately. Assess the potential impact of incidents and determine the remediation actions required to reduce risk and restore secure operations. Follow established procedures for detecting, documenting, reporting, and escalating security incidents and threat intelligence. Collaborate with engineering, network, application, and security teams to support effective incident resolution and strengthen defensive capabilities. Apply practical AI tools and automation where appropriate to streamline analysis, reduce repetitive work, and improve response efficiency. Requirements Bachelor's degree in Computer Science, Information Systems, Cybersecurity, or a related discipline, or 2–5 years of relevant experience in SOC operations, incident response, or cyber forensics. At least 2 years of SOC experience, including relevant internship experience. Hands-on experience with Splunk SIEM and security log analysis across technologies such as firewalls, proxies, and EDR platforms. Practical experience handling cyber incidents, performing L1 analysis, identifying false positives, and correlating security events. Solid understanding of network architecture, TCP/IP, OSI layers, network and systems architecture, and intrusion detection technologies. Knowledge of web application architecture, Active Directory, and application-layer protocols including HTTP, SMTP, and DNS. Understanding of common malware types and attack techniques, including rootkits, trojans, adware, exploits, and fileless malware. Strong analytical, organizational, documentation, prioritization, and time-management skills. Clear written and verbal communication skills, with the ability to collaborate effectively across technical and organizational teams. Ability to work in a fast-paced environment, manage competing priorities, navigate ambiguity, and make sound decisions with incomplete information. Experience partnering with network, engineering, or application teams is an advantage. Security certifications such as CompTIA Security+ or equivalent are preferred. Familiarity with AI productivity tools such as ChatGPT, Copilot, or similar technologies is a plus. Benefits Competitive compensation and benefits package. Medical, dental, and vision insurance. Provident Fund. Life and accident insurance. Internet, fuel, meal, and telephone allowances. Remote work arrangement within India. Opportunities to work with modern cybersecurity, AI, and automation technologies. A collaborative environment with opportunities to work across security, engineering, network, and application functions. Benefits and eligibility may vary according to location and employment status.