SOC Analyst
First seen by Alion on Oct 29, 2026.
SOC Analyst (Level 1 / Level 2)
Pune, on-site
Full-time
About the role
We're hiring a SOC Analyst to join our Security Operations Center. You'll monitor, investigate and respond to security events across client environments, using enterprise tools and cloud platforms.
This role needs technical depth and clear communication in equal measure. During an incident, you're the person clients and internal teams hear from, and your written reports need to be as sharp as your investigations.
What you'll do
• Monitor alerts across SIEM, EDR, email security and DNS filtering platforms
• Triage and investigate events, separating true and false positives with documented reasoning
• Contain incidents using defined runbooks, and escalate Sev 1 and Sev 2 events to senior analysts and the CISO
• Write clear incident reports for both technical teams and executives with no security background
• Keep clients updated during active incidents: status, containment actions, next steps and timelines
• Analyse phishing emails and report findings through defined channels
• Analyse logs across Microsoft 365, Entra ID, AWS CloudTrail and endpoint management platforms
• Keep ticket documentation accurate and current throughout every investigation
• Take part in post-incident reviews and help improve runbooks
• Track vulnerabilities and coordinate patch updates with system owners
What we're looking for
Experience
• Level 1: 1 to 3 years in a SOC, security helpdesk or IT security role
• Level 2: 3 to 5 years
Technical skills
• Hands-on experience with a SIEM (Microsoft Sentinel, Splunk or similar)
• Microsoft 365 security tools: Defender for Endpoint, Defender for Office 365, Purview Audit, Entra ID sign-in logs
• MITRE ATT&CK and kill chain methodology
• Networking fundamentals: DNS, HTTP/S, TCP/IP, firewall logs
• Reading Windows Event Logs, Azure/Entra sign-in logs and email headers
• AWS or Azure experience is a plus
Communication (non-negotiable)
• Clear, professional written English, without jargon when the audience doesn't need it
• Can write an incident summary a CEO can act on, and a technical timeline an engineer can follow
• Comfortable giving live updates to clients during incidents, including delivering bad news calmly
• Responds promptly and transparently, so stakeholders always know what's happening
• Understands that communication during an incident is itself a security control
Mindset
• Calm under pressure. No going quiet, no public speculation.
• Curious and methodical. Follows evidence, not assumptions.
• Owns tickets end to end and never hands off without context
• Asks questions when scope is unclear instead of guessing
• Works well across time zones with US and India teams
Preferred certifications
• CompTIA Security+
• SC-200 (Microsoft Security Operations Analyst)
• GCIH (GIAC