Roles and Responsibilities
- Monitor security alerts and events through Security Information and Event Management (SIEM) tools.
- Analyze security logs from servers, endpoints, firewalls, and network devices.
- Identify suspicious activities, potential threats, and unauthorized access attempts.
- Investigate security alerts and classify incidents based on severity and priority.
- Perform initial triage and escalation of security incidents.
- Monitor network traffic and identify unusual communication patterns.
- Support incident response activities and follow established security procedures.
- Analyze phishing emails, malicious attachments, and suspicious URLs.
- Monitor endpoint security alerts and antivirus notifications.
- Maintain incident records, investigation notes, and security reports.
- Perform basic threat intelligence research to understand emerging cyber threats.
- Assist in vulnerability management and security assessment activities.
- Follow security policies, procedures, and incident escalation guidelines.
- Collaborate with IT, infrastructure, and cybersecurity teams to resolve security issues.
- Prepare daily, weekly, and monthly security monitoring reports.
Technical Skills Required
- Cybersecurity Fundamentals and Information Security Concepts.
- Security Operations Center (SOC) Fundamentals.
- SIEM Tools (Splunk / IBM QRadar / Microsoft Sentinel).
- Log Monitoring and Security Event Analysis.
- Network Security Fundamentals (TCP/IP, DNS, HTTP/HTTPS).
- Firewall and Endpoint Security Fundamentals.
- Operating Systems (Windows and Linux).
- Incident Detection, Analysis, and Response.
- Threat Intelligence and Threat Analysis.
- Vulnerability Management Fundamentals.
- Phishing and Malware Analysis Fundamentals.
- IDS/IPS Concepts.
- MITRE ATT&CK Framework.
- Basic Knowledge of Security Monitoring and Incident Reporting.
- Basic Scripting (Python / PowerShell) – Good to Have.
Required Skills and Competencies
- Strong analytical and problem-solving abilities.
- Excellent attention to detail.
- Good understanding of network and security concepts.
- Ability to identify suspicious activities and security threats.
- Logical thinking and investigation skills.
- Good written and verbal communication skills.
- Ability to work in a team-oriented environment.
- Willingness to learn new cybersecurity tools and technologies.
- Ability to work in a shift-based environment, if required.
- Strong documentation and reporting skills.
Key Performance Indicators (KPIs)
- Accuracy of security alert analysis and classification.
- Timely identification and escalation of security incidents.
- Quality of incident investigation and documentation.
- Effectiveness of security monitoring activities.
- Compliance with incident response procedures.
- Timely completion of assigned security investigations.
- Accuracy and completeness of security reports.
