Engineer-Cybersecurity

Job description

Area(s) of responsibility - Continuously monitor SIEM, EDR, IDS/IPS, firewalls, and log sources for suspicious activity. - Perform initial triage and classification of alerts based on severity, scope, and impact. - Escalate validated incidents to L2 SOC analysts in line with SOC playbooks and escalation matrix. - Verify log ingestion and forwarding from SIEM, EDR, IDS/IPS, and other security platforms. - Identify tool or data gaps and escalate to L2 SOC or security engineering teams. - Maintain accurate and detailed incident records, triage notes, and escalation details. - Document recurring false positives and suggest playbook improvements. - Create and update tickets in the SOC case management system. - Serve as the first point of contact for customer-reported security incidents. - Perform preliminary analysis of suspicious emails, URLs, and attachments. - Follow MSSP and customer-specific SLA-driven escalation workflows. - Review vulnerability scan reports and escalate high-severity findings to L2/security engineers. - Experience in Vulnerability management - Assist in preparing daily/weekly SOC dashboards, reports, and metrics for management and customers.