Role Overview

The SOC L1 Analyst is the first line of defence within the Security Operations Centre (SOC),

responsible for continuous 24x7 monitoring, detection, triage, and initial response to security events and alerts generated by the FortiSIEM platform.

Key Responsibilities

• Monitor security alerts and events on FortiSIEM console on a 24x7 rotational-shift basis.

• Perform real-time triage of security incidents: categorise, prioritise, and validate alerts against

defined use-cases and thresholds.

• Investigate and correlate events from multiple log sources (firewalls, endpoints, servers,

applications, network devices) ingested into FortiSIEM.

• Create, update, and close incident tickets in the ITSM tool (e.g., ServiceNow / Remedy) with

complete documentation.

• Escalate complex/high-severity incidents to SOC L2/L3 Analysts and Incident Response

teams within defined SLA timelines.

• Identify false positives and recommend rule/use-case tuning to the L2/SIEM engineering team.

• Prepare and submit end-of-shift handover reports covering open incidents, pending actions,

and anomaly observations.

• Assist in developing and maintaining SOC runbooks, standard use-cases, and escalation

matrices.

• Ensure compliance with client SLAs for Mean Time to Detect (MTTD) and Mean Time to

Respond (MTTR).

• Participate in shift briefings, monthly reviews, and knowledge-sharing sessions within the SOC

team.

Educational Qualification - B.E. / B.Tech.

Experience Requirements

• Minimum 5 years of hands-on experience in a Security Operations Centre (SOC) environment.

• At least 2 years of direct experience working on a SIEM platform (FortiSIEM preferred; IBM

QRadar / Splunk / Sentinel considered with FortiSIEM upskilling commitment).

• Demonstrated experience in L1 incident monitoring, triage, and escalation across multi-tenant

or enterprise SOC environments.

• Prior experience working in 24x7 shift-based operations is mandatory.

• Experience with ITSM tools for incident ticket management (ServiceNow, Remedy, Jira

Service Management, or equivalent).

Security Operations Center Analyst