Key Responsibilities

On a day‑to‑day basis, the candidate will be expected to:

1. Initial Alert Validation
   Review and assess new alerts from security tools (e.g., SIEM, EDR, NDR, CSPM, email security) to determine legitimacy and eliminate false positives.

2. Enrichment and Context Gathering
   Collect and analyze supporting data such as asset ownership, user identity, IP/geo reputation, related events, recent system changes, and threat intelligence.

3. Correlation and Deduplication
   Identify related alerts or incidents, correlate activity across tools, merge duplicate cases, and recognize patterns that may indicate broader attack campaigns.

4. Decisioning and Routing
   Determine whether alerts should be closed, escalated, or tuned, and route confirmed incidents with clear, concise summaries.

5. Runbook Adherence and Improvement
   Follow established triage playbooks and procedures while identifying gaps or opportunities for improving alert handling workflows.

6. Documentation and Evidence Capture
   Accurately document investigation steps, timestamps, artifacts (e.g., logs, IPs, file hashes, screenshots), and decision rationale to support incident response and potential forensic analysis.

7. Feedback to Detection Engineering
   Provide actionable feedback on alert quality, false positive trends, detection gaps, tuning opportunities, and potential new indicators of compromise (IOCs).

8. Communication and Handoff
   Deliver clear handoffs and status updates to teammates across shifts to ensure continuity of investigations.

Ideal Candidate Background

The ideal candidate will have:

• Hands‑on experience analyzing cybersecurity threats and security events
• Prior exposure to a Security Operations Center (SOC) or similar monitoring environment
• Strong documentation skills, with the ability to clearly record findings, evidence, and response recommendations

Required Skills and Qualifications

• Bachelor’s degree in Computer Science, Computer Engineering, Cybersecurity, Digital Forensics, or equivalent practical experience
• 0.5 – 1 year of relevant cybersecurity or security monitoring experience
• Foundational knowledge of cybersecurity concepts, threats, and defensive controls
• Ability to follow structured processes and work effectively in a shift‑based environment

Preferred Skills and Qualifications

The following will set a candidate apart:

• One or more cybersecurity certifications, such as:
  • CompTIA Security+
  • CCNA CyberOps
  • CCSP
  • GCIA / GCIH
  • CEH
  • CySA+
  • OSCP
• Experience working with multiple security tools and data sources
• Strong analytical mindset with attention to detail and sound judgment under pressure
• Effective written and verbal communication skills