Security Operations Center Analyst

SIEM and analytics: Microsoft Sentinel incident management, KQL, analytics rules, workbooks, automation rules, Data Collection Rules and connector health.

Endpoint and identity: Microsoft Defender XDR, Defender for Endpoint, Microsoft Entra ID, risky-user and sign-in investigation.

Agentic SOC: Strike48-generated summaries, evidence packages, correlation, investigation workflows, agent output validation and controlled response orchestration.

Response and case management: Incident prioritisation, ticketing, evidence preservation, containment recommendations, closure rationale and post-incident review.

Governance: SLA, MTTA, MTTR, false-closure rate, analyst override rate, automation failure rate and audit evidence.