SOC L1/Tech Support

Duties and Responsibilities

• Monitor SIEM dashboards, alerts, and security events across network, endpoint, cloud, and application log sources on a 24/7 shift rotation.
• Perform initial triage, classification, and prioritization of security alerts following documented playbooks and runbooks.
• Escalate validated or complex incidents to SOC L2 with complete and accurate documentation of findings and actions taken.
• Record all alerts, investigations, and response actions in the case management/ticketing system.
• Perform routine health checks on security monitoring tools and report gaps in log sources or detection coverage.
• Triage phishing reports and user-reported security concerns, executing first-response steps per playbook.
• Execute containment actions as directed by SOC L2 or the incident lead during active incidents.
• Contribute tuning recommendations to reduce false positives and improve alert quality.
• Maintain complete shift-handover logs to ensure continuity of monitoring between shifts.

Key Performance Indicators/ Key Success Factors

• Mean time to acknowledge (MTTA) alerts within defined SLAs.
• Alert triage accuracy and quality of escalations to SOC L2.
• Percentage of alerts and cases handled within SLA.
• Completeness and quality of case documentation and shift handovers.
• False-positive identification and tuning recommendations submitted.