SOC Analyst L1

Client of Emploipartner

Surveillance & d tection :

• Ensure continuous monitoring of security solutions (SIEM, EDR, NDR, Anti-DDoS, Firewall, sandbox, network equipment, etc.).
  
• Verify that logs are being correctly retrieved and that monitoring sources are available.
  
• Report any anomalies or malfunctions of the security tools.
  

Analyse & qualification:

• Analyze and qualify alerts from different detection tools.
  
• Identify false positives and document treated incidents.
  
• Enhance alerts using Threat Intelligence sources (IP, domains, hash).
  
• Perform first-level incident analyses (simple timeline, identification of IOCs).
  

Incident response:

• Apply the operational procedures as well as the level 1 incident response playbooks.
  
• Perform the first remediation actions (isolate the machine, block IP addresses, deactivate compromised accounts, etc.).
  
• Escalate confirmed or complex incidents to L2 level or the SOC manager.
  

Management & reporting:

• Manage incident tickets (creation, tracking and closure) via the ddi tool.
  
• Ensure complete traceability of actions performed during shifts.
  

Coordination & communication :

• Ensure smooth handovers between teams to guarantee continuity of service.
  
• Collaborating with technical teams (network, systems, development) in the context of incident resolution.
  

Continuous improvement & monitoring:

• Participate in the continuous improvement of detection rules (SIEM tuning, reduction of false positives).
  
• Contribute to updating the playbooks and SOC procedures.
  
• To ensure security monitoring of emerging threats.
  
• Participate in simulation exercises (incident management).

• Bachelor's degree (BAC+3) or Master's degree (BAC+5) in cybersecurity or equivalent field.
  
• Solid basic knowledge in information systems security.
  
• Prior experience in cybersecurity or systems/network administration is preferred.
  
• Experience in a SOC environment is an asset.
  
• Good understanding of Cloud and Datacenter environments.
• Log analysis capabilities (Windows, Linux and security solutions).
  
• Good mastery of the MITRE ATT&CK framework.
  
• Experience with SIEM, EDR or XDR tools.
  
• Knowledge of Threat Hunting and proactive detection (IOC, TTP, LOLBins).
  
• Solid foundations in networking: TCP/IP, DNS, HTTP, SMTP.
  
• Ability to analyze packet captures using tools like Wireshark and tcpdump.