SOC Analyst L1 – Security Operations Center

About the role

The SOC Analyst L1 is the first line of defense in Qicard's Security Operations Center. You will monitor security events around the clock, perform initial triage of alerts, and ensure timely escalation of confirmed or suspected incidents.

Key responsibilities

• Monitor SIEM dashboards and security consoles 24×7 for anomalous activity.
• Perform first‑level triage of alerts from Cisco FTD/FMC, Palo Alto NGFW, Fortinet FortiGate, and Cortex XDR.
• Classify and prioritize incidents according to SOC runbooks and escalation procedures.
• Document and track all security events in the ticketing/case management system.
• Escalate confirmed or suspected incidents to SOC L2 analysts with concise findings.
• Review firewall logs, IDS/IPS alerts, and endpoint telemetry for indicators of compromise.
• Monitor Prisma Access/SASE dashboards for policy violations and cloud threat events.
• Conduct basic threat lookups using threat intelligence feeds, VirusTotal, and open‑source tools.
• Assist in tuning false‑positive alerts under guidance of senior analysts.
• Participate in SOC drills, tabletop exercises, and knowledge‑sharing sessions.

Required profile

• Bachelor’s degree in Computer Science, IT, Cybersecurity or equivalent practical experience.
• Basic understanding of TCP/IP, OSI model, routing and switching.
• Familiarity with common attack vectors such as phishing, malware, DDoS and credential theft.
• Strong written and verbal communication skills for shift handovers and incident reports.
• High attention to detail and ability to work under pressure in a fast‑paced environment.
• Willingness to work rotating shifts including nights, weekends and public holidays.

Required skills

• Cisco firewall and security management tools.
• Palo Alto Networks NGFW.
• Fortinet FortiGate.
• Cortex XDR endpoint protection.
• Prisma Access / SASE.
• SIEM platforms (e.g., Splunk, IBM QRadar, Microsoft Sentinel).
• Threat intelligence tools such as VirusTotal.