We are looking for a SOC Security Engineer – Tier 1 to support our MSSP operations and provide security monitoring services to multiple enterprise customers. The role focuses on security event monitoring, alert investigation, incident triage, log analysis, and escalation, while supporting SIEM operations and detection engineering activities.
Key Responsibilities
Monitor and investigate security alerts from SIEM, EDR/XDR, IDS/IPS, and other security solutions.
Perform initial alert triage, identify suspicious activities, classify incidents, and distinguish true positives from false positives.
Analyze and correlate logs from Windows, Linux, K8s, Active Directory, firewalls, VPNs, proxies, DNS, endpoints, email, and cloud environments.
Investigate common security threats, including brute-force attacks, phishing, malware, ransomware, privilege escalation, and lateral movement.
Conduct initial incident investigations, collect evidence, identify IOCs, and document findings.
Follow incident response procedures and escalate security incidents to Tier 2 teams with clear technical reports.
Perform authorized initial containment actions when required.
Operate SIEM platforms, perform searches, analyze events, and identify monitoring gaps.
Support development, testing, validation, and tuning of SIEM detection rules and correlation use cases.
Apply MITRE ATT&CK, Sigma, and threat intelligence to improve detection capabilities.
Support basic threat hunting and false-positive reduction.
Follow customer-specific SLAs, escalation procedures, and confidentiality requirements.
Maintain accurate incident records, reports, and shift handovers across multiple customer environments.
Required Technical Skills
Understanding of SOC operations, incident response, alert triage, and escalation procedures.
Hands-on experience with at least one SIEM (Splunk, Elastic Security).
Knowledge of Windows, Linux, K8s, Active Directory, authentication, and enterprise infrastructure.
Understanding of TCP/IP, DNS, HTTP/HTTPS, VPN, firewalls, and network protocols.
Familiarity with EDR/XDR, endpoint security, email security, and cloud environments.
Understanding network traffic analysis and using NTA.
Knowledge of security logs, event correlation, IOCs, and common attack techniques.
Familiarity with MITRE ATT&CK, Sigma, and query languages such as KQL or SPL.
Basic Python or PowerShell scripting is an advantage.
Qualifications and Experience
Bachelor's degree in IT, Computer Science, Cybersecurity, or equivalent experience.
1 year of experience in SOC operations, security monitoring, or incident response.
Practical experience with SIEM platforms and security log analysis.
Understanding of enterprise security technologies.
MSSP or multi-customer SOC experience is an advantage.
Professional Competencies
Strong analytical and problem-solving skills.
Attention to detail and investigative mindset.
Ability to work under pressure and manage multiple alerts.
Good technical reporting and communication skills.
Teamwork, accountability, confidentiality, and willingness to learn.
Availability for shift-based operations, including 24/7 rotations if required.
Key Performance Indicators (KPIs)
Compliance with customer SLAs and response targets.
Accuracy of alert triage and incident classification.
Mean Time to Acknowledge (MTTA) and Mean Time to Triage (MTTT).
Quality of incident investigation, escalation, and documentation.
Compliance with SOC procedures and shift handover requirements.
Contribution to detection improvement and false-positive reduction.