SOC Analyst (L1)

About the role

The SOC Analyst (Level 1) will monitor security alerts, analyse logs, and detect potential threats across the organization’s infrastructure. You will support incident response by performing initial triage, escalating validated incidents, and maintaining accurate records to ensure compliance and continuous improvement of the SOC.

Key responsibilities

• Monitor SIEM and security tools (e.g., Wazuh) for alerts, anomalies, and suspicious activity.
• Perform initial triage and correlation of logs from firewalls, routers, and servers.
• Identify and escalate potential threats such as unauthorized access, port scans, malware, and traffic anomalies.
• Assist in incident investigations, document actions, and support containment and recovery.
• Review basic threat intelligence feeds and assist with vulnerability scanning and reporting.
• Maintain audit‑ready logs and support compliance with regulatory frameworks (e.g., ISO 27001, PTA requirements).
• Prepare daily, weekly, and monthly SOC monitoring reports.
• Participate in security drills, testing, and continuous‑improvement initiatives.

Required profile

• Bachelor’s degree in Cybersecurity, Computer Science or a related field.
• 1–2 years of experience in a SOC, NOC, or IT operations environment.
• Understanding of network security concepts, firewalls, IDS/IPS, and VPNs.
• Hands‑on experience with incident response and threat analysis.

Required skills

• SIEM platforms – specifically Wazuh.
• Firewalls and core routers.
• Windows and Linux server environments.
• EDR/XDR tools.
• IDS/IPS and VPN technologies.
• Threat intelligence feed analysis.
• Vulnerability scanning and remediation tracking.