ShortlistFox
← Back to results

Security Operations & Incident Response Analyst

abra

South

  • Onsite
  • Full Time
Apply

About the role

Description

abra professional services is seeking a Security Operations & Incident Response Analyst!

Job Description:

Responsible for handling information security incidents escalated by an external 24/7 SOC team, conducting in-depth investigations, classifying incidents, and coordinating response activities with Infrastructure, Information Security, and Incident Response teams.

Key Responsibilities:

  • Receive security alerts and incidents from an external SOC team, analyze them, and classify them based on severity and urgency.
  • Investigate cybersecurity incidents using SIEM, EDR/XDR, logs, and infrastructure systems.
  • Identify and classify false-positive alerts based on findings and supporting evidence.
  • Coordinate and lead the operational handling of security incidents with IT and Incident Response teams.
  • Perform or coordinate containment, remediation, and security hardening activities following security incidents.
  • Analyze anomalous activity across Windows, Active Directory, network, and enterprise environments.
  • Work with the SOC provider to improve detection rules, alert quality, and false-positive reduction.
  • Document security incidents, prepare investigation reports, and track remediation activities.
  • Participate in proactive Threat Hunting activities to identify suspicious behavior.

Requirements

Mandatory Requirements:

  • 2–4 years of experience in SOC operations, security incident investigation, or Incident Response.
  • Hands-on experience investigating security incidents and analyzing logs.
  • Experience working with SIEM and EDR/XDR solutions.
  • Good knowledge of Windows environments and Active Directory.
  • Strong independent investigation and analytical skills, with the ability to collaborate effectively across multiple teams.

Advantages:

  • Experience investigating incidents at a SOC Tier 2 level.
  • Experience working with an external SOC team/provider.
  • Experience with Microsoft Defender, Microsoft Sentinel, Trend AI, or similar security solutions.
  • Familiarity with Microsoft 365 and Entra ID.
  • Experience with Incident Response and Threat Hunting processes.