SOC ANALYST

Responsible for 24x7 monitoring, detection, triage, andresponse to security events across the security stack, including Trend Micro,Microsoft Sentinel (SIEM), and related tools. Also supports data lossprevention (DLP), patch compliance, and vulnerability management, so thatthreats are detected quickly, weaknesses are remediated on time, and sensitivedata stays protected.

Key Responsibilities:

Security Monitoring & Incident Response

Monitor alerts and dashboards across Trend Micro (e.g.Vision One, Deep Security, Apex One), Microsoft Sentinel, and other securitytools

Triage alerts, separate true from false positives, andprioritise by severity and business impact

Investigate suspicious activity using log analysis, KQLqueries, and threat intelligence

Escalate confirmed incidents to L2/L3 or the incidentresponse team with clear evidence

Carry out initial containment per playbooks, such asisolating endpoints or blocking indicators

Tune detection rules and alert thresholds to reduce noise

Data Loss Prevention (DLP)

Monitor and triage DLP alerts for unauthorised transfer,sharing, or exfiltration of sensitive data

Investigate policy violations, determine whether they areaccidental, negligent, or malicious, and escalate as required

Review and tune DLP policies and rules to reduce falsepositives

Coordinate with data owners, HR, and compliance on confirmeddata leakage incidents

Report DLP incident trends and policy effectiveness

Vulnerability Management

Run and review vulnerability scans using Tenable and similartools

Prioritise findings by severity (CVSS), exploitability, andasset criticality

Raise remediation tickets, track them to closure, andescalate overdue items

Manage risk acceptance and exception requests withsupporting justification

Produce vulnerability and patch compliance reports formanagement and audits

Documentation & Reporting

Document incidents and investigations in the ticketingsystem (e.g. ServiceNow)

Maintain SOC playbooks, runbooks, and SOPs

Prepare shift handover notes and regular security reports

Support audits, compliance checks, and post-incident reviews

Qualifications:

Diploma or Bachelor’s degree in Cybersecurity, IT, ComputerScience, or a related field (or equivalent experience)

2-4 years in a SOC, security operations, or IT security role

Hands-on experience with a SIEM (Microsoft Sentinelpreferred) and endpoint or XDR tools (Trend Micro preferred)

Experience with vulnerability scanners (Tenable preferred)and patch management processes

Understanding of DLP concepts and tools, and of the incidentresponse lifecycle and MITRE ATT&CK

Preferred certifications: CompTIA Security+, MicrosoftSC-200, or Trend Micro certifications

Nice to have: CEH, GCIH, GCIA, Tenable certifications, orAzure/AWS security certifications

Skills:

Strong knowledge of network, endpoint, cloud, and OSsecurity (Windows, Linux)

Ability to write and read KQL queries and analyse logs

Familiarity with firewalls, IDS/IPS, WAF, EDR/XDR, DLP, andvulnerability scanners

Understanding of CVSS scoring, CVE tracking, and risk-basedremediation prioritisation

Strong analytical thinking, attention to detail, and clearwritten and verbal communication

Ability to work with infrastructure and application teams todrive remediation

Calm and effective under pressure and in shift work