Job Description: Responsible for handling information security incidents escalated by an external 24/7 SOC team, conducting in-depth investigations, classifying incidents, and coordinating response activities with Infrastructure, Information Security, and Incident Response teams. Key Responsibilities:
* Receive security alerts and incidents from an external SOC team, analyze them, and classify them based on severity and urgency
* Investigate cybersecurity incidents using SIEM, EDR/XDR, logs, and infrastructure systems
* Identify and classify false-positive alerts based on findings and supporting evidence.
* Coordinate and lead the operational handling of security incidents with IT and Incident Response teams
* Perform or coordinate containment, remediation, and security hardening activities following security incidents.
* Analyze anomalous activity across Windows, Active Directory, network, and enterprise environments
* Work with the SOC provider to improve detection rules, alert quality, and false-positive reduction
* Document security incidents, prepare investigation reports, and track remediation activities.
* Participate in proactive Threat Hunting activities to identify suspicious behavior.
Requirements: Mandatory Requirements: 2-4 years of experience in SOC operations, security incident investigation, or Incident Response
* Hands-on experience investigating security incidents and analyzing logs
* Experience working with SIEM and EDR/XDR solutions.
* Good knowledge of Windows environments and Active Directory
* Strong independent investigation and analytical skills, with the ability to collaborate effectively across multiple teams. Advantages:
* Experience investigating incidents at a SOC Tier 2 level.
* Experience working with an external SOC team/provider
* Experience with Microsoft Defender, Microsoft Sentinel, Trend AI, or similar security solutions.
* Familiarity with Microsoft 365 and Entra ID
* Experience with Incident Response and Threat Hunting processes.
This position is open to all candidates.