SOC Analyst

Experience 4 to 6 years in Information Technology (IT) and or Information Security (IS)

1.At least 3 years of working knowledge in a Security Operation Center (SOC)

2.Proficient in Incident Management and Response

3.In-depth knowledge of security concepts such as cyber-attacks and techniques, threat vectors, risk management, incident management, analysis methods, etc.

4.Capable of working in a 24x7 shift-based SOC environment.

5.Enhanced knowledge of analysis and trending of security log data from a large number of heterogeneous security devices

6.Advanced proficiencies in threat and vulnerability analysis as well as in providing security advisory services.

The L2 analyst is responsible for:

1. L1 to be notified for adequacy of investigation and based on Runbooks. Provide daily feedback to Analysts irrespective of any incident is getting created.

2. Review all the alerts before notifying to clients.

3. To escalate timely when the SLA for alerting is not adhered by the L1 analyst as defined.
4. Provide RCA if SLA missed.
5. To monitor and identify the incidents if there are any missed/mishandled by L1 Analyst.
6. To manage and maintain incidents knowledge base.
7. To generate the monthly reports on time.maintain the timely delivery of reports.
8. Ad hoc Review incident feedback provided by customer daily to identify if any changes needed to use cases or Runbooks.
9. Monthly Review Ensure runbooks are available for all triggering use cases.
10. Notify SOC leads if any runbooks are missing or need major update.
11. Daily Review- shift handover sheet. Provide feedback to Analyst if any.
12. Daily Review all daily deliverables are being provided (Alerts and Health check).
13. Daily Review of Log stoppage for all devices (and resolution status).
14. Daily Review - Any Email or request from customer pending response.
15. Monthly Check Ensure alert recipients and Report recipients are current and updated.
16. Notify SOC lead about any non-performing or non-discipline from Analysts.
17. Track and reduce false positive ratio.
18. Whitelisting and automating the rule as per customer request.
19. Maintain and update issue tracker with customer.
20. Provide First response for customer complaints and escalations. track escalations to closure.