Security Operations Center Analyst

About the role

The Security Operations Center (SOC) Analyst is the first line of defence in a 24x7 security operations environment. You will monitor, detect, triage and initiate response to security events using the FortiSIEM platform, ensuring compliance with client SLAs for detection and response times.

Key responsibilities

• Monitor security alerts on the FortiSIEM console on a rotating 24x7 shift.
• Perform real‑time triage: categorize, prioritize and validate alerts against defined use‑cases.
• Investigate and correlate events from firewalls, endpoints, servers, applications and network devices.
• Create, update and close incident tickets in ITSM tools such as ServiceNow or Remedy with full documentation.
• Escalate complex or high‑severity incidents to SOC L2/L3 analysts and incident response teams within SLA timelines.
• Identify false positives and suggest rule or use‑case tuning to the SIEM engineering team.
• Prepare end‑of‑shift handover reports covering open incidents and pending actions.
• Assist in maintaining SOC runbooks, standard use‑cases and escalation matrices.

Required profile

• B.E. / B.Tech. degree.
• Minimum 5 years of hands‑on experience in a SOC environment.
• At least 2 years of direct experience with a SIEM platform (FortiSIEM preferred; IBM QRadar, Splunk or Microsoft Sentinel acceptable with up‑skilling commitment).
• Proven experience in L1 incident monitoring, triage and escalation in multi‑tenant or enterprise settings.
• Prior experience working in 24x7 shift‑based operations.
• Experience with ITSM tools for incident ticket management (ServiceNow, Remedy, Jira Service Management or equivalent).

Required skills

• FortiSIEM
• IBM QRadar
• Splunk
• Microsoft Sentinel
• ServiceNow
• Remedy
• Jira Service Management
• Log analysis from firewalls, endpoints, servers, applications and network devices
• Incident ticketing and documentation