SOC Tier 1 Security Analyst

Position Overview

This role is responsible for monitoring security events within a Security Information and Event Management (SIEM) platform, performing initial alert analysis and triage, managing event aggregation and correlation, and escalating potentially significant security events to the appropriate security operations teams.

The position operates within a 24 hours per day, 7 days per week, 365 days per year (24x7) security operations environment.

Key Responsibilities

• Monitor security events and alerts within the customer's Google SecOps SIEM platform.
• Perform Tier 1 alert and event triage , assessing alerts for relevance, severity, and potential security impact.
• Review and manage aggregated security events to identify related activity and reduce duplicate or unnecessary tickets.
• Perform initial event correlation to identify potentially related alerts and security activity.
• Create and document security tickets based on identified events and established operating procedures.
• Escalate security events requiring additional investigation or response to appropriate Tier 2/Tier 3 analysts or security teams.
• Monitor and triage alerts generated by the customer's Web Application Firewall (WAF) and ingested into the SIEM.
• Maintain accurate and timely ticket documentation, including relevant alert information, analysis, actions taken, and escalation details.
• Help prevent unnecessary ticket sprawl by appropriately aggregating and correlating related events before creating individual tickets where practical.
• Follow established security operations procedures, escalation criteria, and service-level requirements.
• Support operational reporting and workload metrics related to event monitoring, triage, ticket creation, and escalation.

Preferred Skills and Qualifications

• Experience in a Security Operations Center (SOC) , cybersecurity operations, or security monitoring environment.
• Understanding of common cybersecurity events, alerts, threats, and indicators of compromise.
• Experience with SIEM platforms and security alert investigation.
• Ability to analyze and prioritize security alerts based on severity and potential impact.
• Familiarity with event correlation, aggregation, and escalation processes.
• Strong attention to detail and documentation skills.
• Ability to follow defined procedures while exercising sound judgment when evaluating security alerts.
• Strong written and verbal communication skills.
• Ability to work effectively in a 24x7 operational environment , including assigned shifts, nights, weekends, and holidays as required.

Preferred Qualifications

• Experience with Google SecOps (formerly Chronicle).
• Experience monitoring or triaging Web Application Firewall (WAF) alerts.
• Familiarity with common SIEM concepts including log ingestion, normalization, correlation rules, alerting, and incident/ticket management.
• Security certifications such as CompTIA Security+ , CySA+ , GIAC , or comparable credentials.
• Familiarity with common security frameworks and SOC processes.

Work Environment

This is a 24x7 Security Operations Center role supporting continuous security monitoring. Candidates must be comfortable working an assigned shift schedule that may include overnight shifts, weekends, and holidays .
Job Type: Full Time 3rd Shift
Hours: Saturday - Wednesday 12AM - 9AM
Location: Onsite

What You’ll Do

As a Tier 1 SOC Analyst, you will serve as a first line of defense by monitoring security activity, identifying potentially significant events, documenting findings, and ensuring appropriate events are escalated for further investigation. Success in this role requires strong attention to detail, disciplined ticket management, and the ability to distinguish meaningful security activity from routine or duplicate alerts.