SOC L1

Primary Responsibilities

Real-time monitoring of all security appliance(s) like Secure Web/ Email Gateways, Proxy, IPS/ IDS, NGFW, DLP, APT, WAF, Network Forensics, SIEM, NAC, SOAR, etc. in RSDC for security events.

Endpoint Threat Detection

Take SOAR action on identified malicious communications

Monitor and alert any abnormalities identified

Work on ticket and ensure timely response and resolution of tickets as per SLA

Reporting the security events/ incidents to Tier-2 and other relevant/ designated stakeholders

Communicating Emergency Alerts & Warnings to relevant/designated stakeholders

Secondary Responsibilities:

• SIEM (Security Information and Event Management):

• Configure, manage, and fine-tune SIEM tools for log ingestion, correlation rules, alerting, and reporting.

• Perform threat hunting, incident analysis, and security event investigations.

• Develop and maintain custom use cases to detect advanced threats.

• NBAD (Network Behavior Anomaly Detection):

• Monitor and analyze network traffic to identify anomalies indicating potential threats or breaches.

• Work with network and SOC teams to investigate and respond to suspicious network behavior.

• General:

• Collaborate with incident response, threat intelligence, and risk management teams.

• Continuously review and enhance detection rules based on emerging threats.

• Document all procedures, incidents, and findings properly for audit and knowledge management.