L1 System Engineer

Job Title

Department

Experience

Job Summary:

L1 System Engineer

Key Responsibilities

• Monitor security events and network traffic using SIEM tools such as Splunk ESM and Azure Sentinel.
• Identify, analyze, and respond to security incidents and alerts within defined SLAs.
• Conduct first-level incident triage, including validation, categorization, and escalation as required.
• Develop and maintain security use cases and alert triage policies to identify root causes and prevent recurrence.
• Perform malware analysis and threat detection through real-time monitoring and vulnerability assessments.
• Collaborate with L2/L3 teams for complex incident resolution and contribute to continuous SOC process improvement.
• Ensure accurate reporting, documentation, and shift handovers to maintain communication and operational efficiency.
• Support the deployment and configuration of SOC environments and integrations using Splunk Enterprises and ServiceNow.
• Utilize the MITRE ATT&CK framework to identify adversarial tactics, techniques, and procedures (TTPs).
• Work with security technologies including IDS/IPS, firewalls, endpoint security, content filtering, and packet inspection tools.

Required Skills and Qualifications

• Bachelors degree in Computer Science, Information Technology, or related field.
• 1–3 years of experience in a SOC or system security role (L1 or L2).
• Proficiency in tools such as Splunk, Azure Sentinel, ServiceNow, and other SOC technologies.
• Strong understanding of incident management and change management processes.
• Knowledge of vulnerability management, threat intelligence, and malware analysis.
• Familiarity with MITRE ATT&CK, SIEM correlation techniques, and security frameworks.
• Excellent communication, analytical, and report-writing skills.
• Ability to work effectively in a 24/7 rotational shift environment.

Preferred Qualifications

• Relevant certifications such as CompTIA Security+, CEH, or Splunk Certified User.
• Exposure to network forensics, log analysis, and endpoint protection tools.
• Experience in adapting and improving SOC procedures and incident response playbooks.