SOC Analyst I

Monitor security alerts and incidents generated by Microsoft Defender XDR, Microsoft Sentinel, and other security tools.

Perform initial triage and validation of security events.

Investigate common security threats, including phishing, malware, unauthorized access attempts, and suspicious user activity.

Escalate high-risk or complex incidents to senior analysts.

Assist in identifying, containing, and documenting security incidents.

Collect and analyze evidence from endpoints, identity systems, email security tools, and cloud environments.

Follow established incident response procedures and playbooks.

Review and analyze Windows Event Logs, Microsoft Entra ID sign-in logs, Microsoft 365 audit logs, Microsoft Defender telemetry, network logs, and firewall logs.

Correlate information across multiple data sources to identify potential threats.

Review alerts from Microsoft Defender XDR and perform basic investigations using Microsoft Sentinel.

Execute basic KQL queries for incident analysis and assist with security monitoring and detection validation.

Search for Indicators of Compromise (IOCs).

Review threat intelligence provided by the security team and assist in basic threat hunting activities.

Maintain accurate incident records and case notes.

Document investigative findings and remediation activities.

Contribute to knowledge base articles and operational procedures.

Understanding of cybersecurity fundamentals (Confidentiality, Integrity, and Availability [CIA], attack lifecycle, phishing and social engineering attacks, MITRE ATT&CK Framework).

Basic networking knowledge (TCP/IP, DNS, DHCP, HTTP/HTTPS).

Basic Windows operating system knowledge.

Familiarity with Microsoft 365 and cloud security concepts.