- Monitor, triage, and investigate alerts across SIEM, EDR, Microsoft security tools, and cloud platforms.
- Analyze host and network logs from Windows, Linux, databases, applications, web servers, firewalls, and NIDS/HIDS.
- Investigate suspicious activity, identify root causes, and determine remediation or escalation.
- Support incident response, remediation, and recovery activities.
- Work with Incident Response and other cybersecurity teams to manage threats.
- Analyze network and security events using TCP/IP, syslog, firewall, and network monitoring data.
- Tune and optimize detections to improve quality and reduce false positives.
- Gather technical information from clients to improve security monitoring and detection.
- Prepare and present security reports, summaries, and technical findings.
- Maintain SOC procedures, documentation, knowledge bases, and quality-control processes.