SOC Analyst L1 – Entry Level Cybersecurity Monitoring

About the role

We are looking for a motivated SOC Analyst L1 to join our security operations team. You will be the first line of defence, monitoring alerts from multiple security tools, triaging events, and ensuring that potential threats are documented and escalated according to our playbooks.

Key responsibilities

• Monitor security events in SIEM, EDR and network detection tools.
• Perform initial triage and classification of alerts (benign, false‑positive, suspicious, incident).
• Collect and review basic evidence such as endpoint telemetry, Windows/Linux logs, firewall, IDS, DNS and proxy data.
• Execute authorised runbooks (e.g., password reset, IOC block, host isolation).
• Create detailed tickets with clear narrative, evidence, impact assessment and recommended next steps.
• Escalate cases to L2/L3 or incident response when compromise or high risk is identified.
• Provide structured shift handovers and meet operational SLAs.

Required profile

• 0‑2 years of experience in SOC, NOC or IT security operations, or equivalent hands‑on lab work.
• Solid fundamentals in networking (TCP/IP, DNS, HTTP/S, VPN, NAT).
• Basic working knowledge of Windows and Linux operating systems and log concepts.
• Strong spoken and written English (minimum B2) for clear ticketing and calls.
• Attention to detail, structured thinking and ability to work under pressure.

Required skills

• Experience with SIEM/EDR/IDS tools (e.g., Wazuh, Splunk, Microsoft Sentinel, QRadar, Defender, CrowdStrike, Suricata, Snort).
• Ability to interpret log fields (source/destination, user, process, hash, URL, action, result).
• Basic query skills (KQL, SPL, Lucene, DQL) – nice to have.
• Familiarity with MITRE ATT&CK framework – nice to have.
• Entry‑level certifications such as Security+, BTL1, CySA+ – nice to have.