• Monitor, investigate, and respond to security alerts and incidents generated by SIEM, SOAR, EDR/XDR, and other security monitoring platforms.
• Perform real-time analysis of suspicious host, network, and user activity to identify potential cybersecurity threats and security breaches.
• Triage, prioritize, and coordinate remediation of security events in accordance with incident response procedures and service level objectives.
• Conduct network, endpoint, firewall, proxy, IDS/IPS, and system log analysis to determine the scope, impact, and root cause of security incidents.
• Research emerging cyber threats, attack techniques, vulnerabilities, and threat actor activities and provide actionable intelligence to strengthen the organization's security posture.
• Contribute to threat hunting activities by proactively identifying indicators of compromise (IOCs), anomalous behavior, and potential security gaps.
• Support end-to-end incident response activities, including detection, containment, eradication, recovery, documentation, and post-incident reviews.
• Leverage the MITRE ATT&CK framework and threat intelligence sources to improve detection capabilities and investigation effectiveness.
• Collaborate with Security Engineering, Infrastructure, Network, and IT Operations teams to mitigate risks and implement security improvements.
• Participate in purple team exercises, tabletop simulations, and security assessments to evaluate and strengthen defensive controls.
• Develop and maintain security documentation, operational procedures, investigation playbooks, and knowledge-sharing resources.
• Generate and communicate operational metrics, security trends, and incident summaries to leadership and key stakeholders.
• Assist with Active Directory, identity security, access control reviews, and user account investigations when required.
• Contribute to the continuous improvement of SOC processes, automation initiatives, detection rules, and security monitoring capabilities.
• Participate in a 24x7 security operations environment, including on-call or shift-based coverage as required.

Required Qualifications

• Bachelor’s degree in Computer Science or a related technology field or equivalent in comparable work experience within the information security field.
• Greater than 2-5 years’ experience in cybersecurity operations.
• Experience with SIEM and SOAR platforms.
• Experience with EDR/XDR platforms.
• Strong understanding of network infrastructure devices such as firewalls, proxies, routers, switches,IDS/IPS.
• Strong understanding of cybersecurity concepts such as authentication procedures, access controls, encryption, etc.
• Good understanding of modern cyber threats.
• Good understanding of Incident Response principles.
• Good understanding of the MITRE ATT&CK framework.
• Certified in a reputable cybersecurity-related certification such as CompTia Security+, or equivalent or     greater certification; total cybersecurity experience will be considered as a certification substitute.

Preferred Qualifications

• Experience or exposure to network or host forensics.
• Understanding of emerging threats and cyber threat hunting.
• Experience in incident response actions, closing an incident from the initial detection to recovery actions.
• Active Directory skills and experience.