Night Shift SOC Analyst - Level 1

Description: • Monitor alerts from SIEM, firewalls, IDS/IPS, endpoint tools, and other security systems to identify potential incidents. • Triage security alerts by severity, impact, and urgency using established criteria. • Collect and validate initial alert details such as source, target, timestamp, and related logs. • Perform preliminary analysis using playbooks and SOPs to identify false positives or determine whether escalation is needed. • Execute containment actions from playbooks, such as blocking IP addresses or isolating affected systems. • Verify remediation steps are effective and document all actions with timestamps. • Escalate complex, advanced, or high-priority incidents to Level 2 analysts with detailed context and analysis. • Maintain accurate SOC incident records, including alerts, outcomes, and audit-ready documentation. • Communicate status updates, key findings, risks, and required actions to supervisors and response teams. • Collaborate with teammates to resolve blockers and support incident response workflows. Requirements: • Familiarity with SIEM platforms such as Elastic, Splunk, or QRadar, as well as firewalls, IDS/IPS, and endpoint tools. • Basic knowledge of networking concepts including TCP/IP, DNS, VPN, HTTP, and FTP. • Awareness of common threats and attack vectors, including phishing, malware, and DDoS. • Ability to triage alerts and distinguish false positives from real threats. • Experience following playbooks and SOPs for initial response and remediation. • Strong attention to detail for monitoring events, identifying anomalies, and documenting actions. • Clear written and verbal communication skills for reporting findings and escalating incidents. • Ability to collaborate effectively in team-based incident response situations. • Comfort working in a high-pressure, dynamic environment with multiple concurrent tasks. • Willingness to work 24/7 shifts, including nights and weekends; shift schedule includes 7 a.m. - 7 p.m. Mon-Tues-Wed and 7 a.m. - 7 p.m. Sun-Mon-Tues every third or fourth week. • Degree in cybersecurity, IT, or a related field preferred, or equivalent experience. • Entry-level certifications such as CompTIA Security+ or Cisco CCNA preferred, or equivalent experience. • Additional security certifications are desired. Apply tot his job Apply To this Job