The Role
Monitor and triage security alerts in a 24/7 SOC, investigate phishing, malicious domains, credential exposure, vulnerabilities, and other threat indicators. Enrich and analyze IOCs using threat intelligence sources, SIEM, EDR/XDR, and MITRE ATT&CK. Document evidence, maintain incident tickets, follow SOPs and escalation procedures, identify potential incidents, and escalate findings to L2/L3 analysts. Support threat hunting, recurring alert analysis, and SOC process improvements.
Summary Generated by Built In
CloudSEK L1 Security AnalystJob Summary
We are looking for a CloudSEK L1 Security Analyst to join our Security Operations team. The candidate will be responsible for continuous security monitoring, alert triage, initial investigation, threat intelligence enrichment, identification of potential security threats, and timely escalation of confirmed or suspicious incidents to L2/L3 analysts.
The role requires a good understanding of Threat Intelligence, Digital Risk Protection, External Attack Surface Monitoring, phishing, credential exposure, malicious infrastructure, and IOC analysis, along with the ability to follow defined SOPs and playbooks in a 24×7 SOC environment.
Key Responsibilities- Monitor security alerts and events generated through CloudSEK and other security monitoring platforms.
- Perform initial L1 alert triage and analysis based on defined SOPs, playbooks, and escalation procedures.
- Validate and categorize alerts as True Positive, False Positive, or Benign/Informational.
- Monitor and investigate alerts related to:
- Phishing and malicious URLs
- Brand impersonation
- Look-alike and typosquatting domains
- Compromised credentials
- Credential leaks
- Data exposure
- Malicious IP addresses and domains
- Vulnerabilities and exposed services
- External attack surface exposure
- Threat actor infrastructure
- Dark Web / Deep Web indicators
- Perform initial investigation of suspicious domains, URLs, IP addresses, email addresses, credentials, hashes, and other IOCs.
- Enrich IOCs using available threat intelligence sources and determine their relevance and risk.
- Investigate suspicious websites, phishing pages, domains, and brand impersonation attempts.
- Monitor externally exposed assets, domains, applications, services, and technologies for potential security risks.
- Correlate alerts with available SIEM, EDR/XDR, firewall, WAF, email security, and vulnerability management data where required.
- Perform basic analysis of threat intelligence and identify relationships between IOCs, infrastructure, vulnerabilities, and threat activity.
- Identify potential security incidents and escalate confirmed or suspicious cases to L2/L3 analysts with complete investigation details.
- Collect and document relevant evidence and IOCs, including:
- IP addresses
- Domains
- URLs
- File hashes
- Email addresses
- Usernames
- Compromised credentials
- Affected assets
- Perform basic investigation using MITRE ATT&CK techniques and known attack patterns where applicable.
- Follow defined incident response procedures, severity classifications, escalation matrices, and SLAs.
- Maintain accurate incident tickets, investigation notes, evidence, and shift handover reports.
- Support L2 analysts by providing complete initial investigation findings and relevant enrichment.
- Monitor threat intelligence feeds and identify threats relevant to the monitored environment.
- Identify repetitive alerts and recurring threat patterns and highlight them to L2 for further analysis and tuning.
- Participate in IOC-based threat hunting activities under L2/L3 guidance.
- Maintain awareness of emerging threats, vulnerabilities, phishing campaigns, threat actors, and attack techniques.
- Participate in continuous improvement of SOC processes, SOPs, and knowledge base.
- 1–3 years of experience in SOC, Security Monitoring, Cybersecurity Operations, Threat Intelligence, or a related role.
- Hands-on exposure to SIEM platforms such as Splunk, Microsoft Sentinel, QRadar, ArcSight, or equivalent.
- Basic experience with EDR/XDR platforms.
- Good understanding of:
- TCP/IP and networking fundamentals
- DNS
- HTTP/HTTPS
- Firewalls and WAF
- Proxy technologies
- Windows and Linux security fundamentals
- Authentication and access management
- Basic understanding of Threat Intelligence and IOC analysis.
- Ability to investigate and analyze:
- Phishing
- Malicious URLs
- Suspicious domains
- Credential compromise
- Malware indicators
- Malicious IP addresses
- Data exposure
- Vulnerabilities
- External attack activity
- Basic understanding of MITRE ATT&CK and common attack techniques.
- Ability to perform basic IOC enrichment using threat intelligence sources.
- Ability to follow SOPs, playbooks, escalation procedures, and defined SLAs.
- Good analytical, communication, documentation, and incident-handling skills.
- Ability to work effectively in a 24×7 SOC environment.
- Hands-on exposure to CloudSEK or similar Threat Intelligence / Digital Risk Protection platforms.
- Exposure to Attack Surface Management (ASM/EASM).
- Exposure to Digital Risk Protection (DRP).
- Experience with Dark Web / Deep Web monitoring.
- Exposure to credential leak and data leak monitoring.
- Knowledge of phishing, brand impersonation, typosquatting, and malicious domain analysis.
- Exposure to Threat Hunting and IOC-based hunting.
- Exposure to SOAR and security automation.
- Basic scripting knowledge in Python, PowerShell, or Bash.
- Basic understanding of vulnerability management and CVE analysis.
- Certifications such as Security+, CEH, CySA+, SC-200, or equivalent.
- Experience handling phishing, malware, credential compromise, and external threat alerts.
CloudSEK | SOC L1 | Threat Intelligence | Cyber Threat Intelligence | Digital Risk Protection | DRP | External Attack Surface Management | EASM | Attack Surface Management | ASM | Dark Web | Credential Leak | Data Leak | Phishing | Brand Protection | Brand Impersonation | Typosquatting | IOC Analysis | Threat Monitoring | SIEM | EDR/XDR
Experience1–3 years relevant cybersecurity/SOC experience.
Shift24×7 rotational shift environment
Skills Required
- 1–3 years of experience in SOC, security monitoring, cybersecurity operations, threat intelligence, or a related role
- Hands-on exposure to SIEM platforms such as Splunk, Microsoft Sentinel, QRadar, ArcSight, or equivalent
- Basic experience with EDR/XDR platforms
- Understanding of TCP/IP, networking, DNS, HTTP/HTTPS, firewalls, WAF, proxy technologies, Windows and Linux security, and authentication and access management
- Basic understanding of threat intelligence and IOC analysis
- Ability to investigate phishing, malicious URLs, suspicious domains, credential compromise, malware indicators, malicious IP addresses, data exposure, vulnerabilities, and external attack activity
- Basic understanding of MITRE ATT&CK and common attack techniques
- Ability to perform IOC enrichment using threat intelligence sources
- Ability to follow SOPs, playbooks, escalation procedures, and defined SLAs
- Strong analytical, communication, documentation, and incident-handling skills
- Ability to work effectively in a 24/7 rotational SOC environment
- Exposure to CloudSEK or similar threat intelligence and digital risk protection platforms
- Exposure to Attack Surface Management, External Attack Surface Management, or Digital Risk Protection
- Experience with Dark Web, Deep Web, credential leak, or data leak monitoring
- Exposure to threat hunting and IOC-based hunting
- Exposure to SOAR and security automation
- Basic scripting knowledge in Python, PowerShell, or Bash
- Basic understanding of vulnerability management and CVE analysis
- Security+, CEH, CySA+, SC-200, or equivalent certification
Am I A Good Fit?
Get Personalized Job Insights.
Our AI-powered fit analysis compares your resume with a job listing so you know if your skills & experience align.
Success! Refresh the page to see how your skills align with this role.
The Company
What We Do
Infosec is a cybersecurity education company that helps IT and security professionals advance their careers and helps employees become safer online at work and home. Its offerings include Infosec Skills, with more than 1,400 hands-on cybersecurity courses and instructor-led certification boot camps, and Infosec IQ, which provides security-awareness training. Its mission is to equip individuals and organizations to outsmart cybercrime.
