SOC Engineer L1

Key Responsibilities:

• Monitor security events and alerts 24/7 using SIEM and other security monitoring platforms.
• Perform initial triage and investigation of security alerts to determine potential threats.
• Analyze and distinguish between false positives and real security incidents.
• Escalate validated incidents to SOC Level 2/Level 3 teams when necessary based on escalation procedures.
• Perform basic incident containment actions following established incident response procedures.
• Document incidents, maintain ticket updates, report and ensure proper record keeping in the ticketing system.
• Follow incident handling SOPs and ensure response activities meet defined SLA requirements.
• Track and follow up on incidents to ensure timely resolution and closure.
• Intensively cooperate with L2, Regulator and End User to follow-up incident handling.
• Facilitate online collaboration (Teams / Zoom) with others party if critical incident happens.

Requirements:

• Bachelor’s Degree in Computer Science, Cybersecurity, Information Technology, or a related field.
• Basic knowledge of cybersecurity concepts, including SIEM, Firewall, IDS/IPS, WAF, VPN, and EDR.
• Ability to perform basic alert triage, log analysis, and incident documentation.
• Strong analytical and problem-solving skills with attention to detail.
• Good communication skills and a customer-oriented approach.
• Willingness to work in a shift-based environment to support 24/7 security monitoring.