Night Shift SOC Analyst - Level 1
Description:
- Monitor alerts from SIEM, firewalls, IDS/IPS, endpoint tools, and other security systems to identify potential incidents.
- Triage security alerts by severity, impact, and urgency using established criteria.
- Collect and validate initial alert details such as source, target, timestamp, and related logs.
- Perform preliminary analysis using playbooks and SOPs to identify false positives or determine whether escalation is needed.
- Execute containment actions from playbooks, such as blocking IP addresses or isolating affected systems.
- Verify remediation steps are effective and document all actions with timestamps.
- Escalate complex, advanced, or high-priority incidents to Level 2 analysts with detailed context and analysis.
- Maintain accurate SOC incident records, including alerts, outcomes, and audit-ready documentation.
- Communicate status updates, key findings, risks, and required actions to supervisors and response teams.
- Collaborate with teammates to resolve blockers and support incident response workflows. Requirements:
- Familiarity with SIEM platforms such as Elastic, Splunk, or QRadar, as well as firewalls, IDS/IPS, and endpoint tools.
- Basic knowledge of networking concepts including TCP/IP, DNS, VPN, HTTP, and FTP.
- Awareness of common threats and attack vectors, including phishing, malware, and DDoS.
- Ability to triage alerts and distinguish false positives from real threats.
- Experience following playbooks and SOPs for initial response and remediation.
- Strong attention to detail for monitoring events, identifying anomalies, and documenting actions.
- Clear written and verbal communication skills for reporting findings and escalating incidents.
- Ability to collaborate effectively in team-based incident response situations.
- Comfort working in a high-pressure, dynamic environment with multiple concurrent tasks.
- Willingness to work 24/7 shifts, including nights and weekends; shift schedule includes 7 a.m. - 7 p.m. Mon-Tues-Wed and 7 a.m. - 7 p.m. Sun-Mon-Tues every third or fourth week.
- Degree in cybersecurity, IT, or a related field preferred, or equivalent experience.
- Entry-level certifications such as CompTIA Security+ or Cisco CCNA preferred, or equivalent experience.
- Additional security certifications are desired. Apply To this Job