SOC Security Analyst

Job Summary

You will monitor, detect, triage, and respond to security events 24x7 using Trend Micro, Microsoft Sentinel, and related tools. Support data loss prevention, patch compliance, and vulnerability management to protect sensitive data and remediate threats promptly.

Responsibilities

• Monitor security alerts and dashboards across Trend Micro (Vision One, Deep Security, Apex One), Microsoft Sentinel, and other security tools to detect threats continuously
• Triage alerts by analyzing severity and business impact to distinguish true positives from false alarms
• Investigate suspicious activities using log analysis, KQL queries, and threat intelligence to identify security incidents
• Escalate confirmed incidents to L2/L3 or incident response teams with clear evidence for timely resolution
• Perform initial containment actions such as isolating endpoints or blocking indicators following SOC playbooks
• Tune detection rules and alert thresholds to reduce noise and improve alert accuracy
• Monitor and triage Data Loss Prevention (DLP) alerts for unauthorized data transfer, sharing, or exfiltration
• Investigate DLP policy violations to determine intent and escalate incidents as necessary
• Review and adjust DLP policies and rules to minimize false positives and enhance detection
• Coordinate with data owners, HR, and compliance teams on confirmed data leakage incidents
• Report on DLP incident trends and policy effectiveness to stakeholders
• Conduct vulnerability scans using Tenable and similar tools and review scan results for risks
• Prioritize vulnerabilities by severity (CVSS), exploitability, and asset criticality to focus remediation efforts
• Raise and track remediation tickets to closure, escalating overdue items to ensure timely fixes
• Manage risk acceptance and exception requests with appropriate justification documentation
• Produce vulnerability and patch compliance reports for management and audit purposes
• Document incidents and investigations accurately in ticketing systems such as ServiceNow
• Maintain SOC playbooks, runbooks, and standard operating procedures (SOPs) to support operations
• Prepare shift handover notes and regular security reports to ensure continuity and transparency
• Support audits, compliance checks, and post-incident reviews to improve security posture

Required competencies and certifications

• Diploma or Bachelor's degree in Cybersecurity, IT, Computer Science, or related field, or equivalent experience
• 2-4 years of experience in SOC, security operations, or IT security roles
• Hands-on experience with SIEM tools, preferably Microsoft Sentinel, and endpoint or XDR tools, preferably Trend Micro
• Experience using vulnerability scanners such as Tenable and managing patch processes
• Understanding of Data Loss Prevention concepts, incident response lifecycle, and MITRE ATT&CK framework

Preferred competencies and qualifications

• Certifications such as CompTIA Security+, Microsoft SC-200, or Trend Micro certifications
• Additional certifications including CEH, GCIH, GCIA, Tenable certifications, or Azure/AWS security certifications

Skills

• Strong knowledge of network, endpoint, cloud, and OSsecurity (Windows, Linux)
• Ability to write and read KQL queries and analyse logs
• Familiarity with firewalls, IDS/IPS, WAF, EDR/XDR, DLP, andvulnerability scanners
• Understanding of CVSS scoring, CVE tracking, and risk-basedremediation prioritisation
• Strong analytical thinking, attention to detail, and clearwritten and verbal communication
• Ability to work with infrastructure and application teams todrive remediation
• Calm and effective under pressure and in shift work