Engineer-Cybersecurity

Job description

Area(s) of responsibility • Continuously monitor SIEM, EDR, IDS/IPS, firewalls, and log sources for suspicious activity. • Perform initial triage and classification of alerts based on severity, scope, and impact. • Escalate validated incidents to L2 SOC analysts in line with SOC playbooks and escalation matrix. • Verify log ingestion and forwarding from SIEM, EDR, IDS/IPS, and other security platforms. • Identify tool or data gaps and escalate to L2 SOC or security engineering teams. • Maintain accurate and detailed incident records, triage notes, and escalation details. • Document recurring false positives and suggest playbook improvements. • Create and update tickets in the SOC case management system. • Serve as the first point of contact for customer-reported security incidents. • Perform preliminary analysis of suspicious emails, URLs, and attachments. • Follow MSSP and customer-specific SLA-driven escalation workflows. • Review vulnerability scan reports and escalate high-severity findings to L2/security engineers. • Experience in Vulnerability management • Assist in preparing daily/weekly SOC dashboards, reports, and metrics for management and customers.