Executive - Consulting Implementation

SOC Analysts ( ACon)

• Security Monitoring & Alert Handling:
Monitor and triage alerts in SIEM platforms such as Google Chronicle and MS Sentinel.
Investigate security events across log sources, escalate incidents as needed, and document
findings. Participate in alert tuning by identifying false positives and assisting in refining
detection logic.
• Email Security (Antispam, Antiphishing, Antimalware, Impersonation Cases):
Support investigations involving email-based threats such as spam, phishing, malware, and
impersonation (user/domain). Analyze email headers, payloads, and URLs using tools like
• Endpoint Threat Response:
Use SentinelOne for endpoint alert analysis and response. Help contain and remediate
malware incidents by analysing behavioural traces and telemetry.
• Vulnerability Management Support:
Operate Tenable solutions (e.g., Nessus, Tenable.io) to conduct vulnerability scans. Assist
in interpreting scan results and collaborating with stakeholders on remediation.
• Threat Intelligence & Enrichment:
Use Recorded Future to enrich alert context and identify related IOCs or threat actor activity.
Support investigation correlation with external threat feeds.
• Threat Hunting Support:
Participate in basic threat hunting exercises following defined hypotheses. Assist in building
and testing detection use cases.
• Log Analysis & Investigations:
Review logs from endpoints, firewalls, and cloud systems to investigate suspicious
behaviors. Document investigation steps and outcomes within internal ticketing and case
tracking tools.
• Incident Runbooks & Documentation:
Follow and contribute to incident response playbooks and knowledge base articles. Ensure
clear documentation of actions taken during investigations.
Experience: 1 to 4 years