- Company Name
- Morton
- Job Title
- Incident Responder / SOC Analyst (8754)
- Job Description
-
**Job Title**
Incident Responder / SOC Analyst
**Role Summary**
Support Tier 1 and Tier 2 SOC functions by monitoring alert streams, investigating incidents, correlating threat intelligence, and executing containment and recovery actions. Operates on SIEM, EDR, and NDR platforms, and contributes to playbook and detection rule refinement.
**Expectations**
- Respond to and triage alerts from SIEM, EDR, and NDR tools.
- Investigate, validate, and document incidents, including evidence preservation.
- Leverage threat intelligence and MITRE ATT&CK frameworks to enhance detection and response.
- Escalate complex cases for advanced forensic analysis.
- Coordinate containment (host isolation, account lockdown, segmentation) and recovery.
- Update incident response playbooks and tune detection rules.
- Prepare incident reports and maintain ticketing system records.
**Key Responsibilities**
1. Monitor and triage alerts, reducing false positives.
2. Conduct in‑depth investigations, assess severity, scope, and impact.
3. Convert telemetry into actionable threat intelligence.
4. Escalate incidents to senior analysts as needed.
5. Apply threat intelligence feeds to improve detection.
6. Assist containment, isolation, and network segmentation.
7. Coordinate system recovery and secure restoration.
8. Refine playbooks and detection rules post‑incident.
9. Tune SIEM and EDR for optimal alert fidelity.
10. Document findings and evidence per standard procedures.
11. Track ticket closure, ensuring SLA compliance and hand‑offs.
12. Contribute to continuous improvement of SOC operations.
**Required Skills**
- 2–5 years in SOC, incident response, or cybersecurity operations.
- Proficiency with SIEM (Splunk, QRadar, Microsoft Sentinel).
- Experience using EDR tools (CrowdStrike, Microsoft Defender, Cisco Secure Endpoint).
- Knowledge of threat intelligence, IOC correlation, and MITRE ATT&CK.
- Understanding of network protocols (TCP/IP, DNS, HTTP) and log analysis.
- Familiarity with Active Directory, Azure AD, and identity‑management concepts.
- Scripting in PowerShell or Python for automation/data parsing.
- Strong technical and non‑technical communication and documentation.
**Required Education & Certifications**
- Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or related field.
- Certifications (earned or in progress):
- CompTIA Security+ or CySA+
- GIAC (GCIA, GCIH, GCFA)
- CISSP (in progress acceptable)
- Microsoft SC‑900 or SC‑200
- Splunk Core User (or equivalent)
Preferred additional skills include SOAR automation, packet capture analysis (Wireshark), cloud security (Azure, AWS), and experience with ticketing systems such as ServiceNow or Jira.