Security Operations Analyst

Role & responsibilities:

• Familiarity with NIST 800-61 or SANS IR cycle
• Containment techniques (isolate endpoint, disable account, block IP/domain).
• Evidence handling & chain of custody.
• Root cause analysis and post-incident reporting

Core Technical Skills:

• Security Monitoring & SIEM Expertise
• Proficiency in tools like Splunk, QRadar, Sentinel, ArcSight, Elastic SIEM.
• Writing correlation rules, dashboards, and alerts.
• Incident Detection & Triage
• Identifying false positives vs. real incidents.
• Prioritizing based on risk/impact.
• Threat Hunting & Analysis
• Using indicators of compromise (IoCs), TTPs, MITRE ATT&CK mapping.
• Proactive search for hidden threats.
• Endpoint & Network Forensics
• EDR tools (CrowdStrike, Carbon Black, Defender for Endpoint).
• PCAP analysis, log review, memory dumps.
• Malware Analysis (Basic to Intermediate)
• Sandboxing, static/dynamic analysis.
• Extracting IoCs.
• Cloud Security Incident Handling
• Understanding AWS, Azure, GCP logs & cloud SIEMs.
• Responding to cloud-specific threats (misconfigurations, key leaks, workload exploits).

Soft Skills

• Calm under pressure during live incidents.
• Collaboration & communication across IT, legal, compliance, and management.
• Continuous learning mindset (new threats evolve daily).
• Work Location: Work from Office