CloudSEK L1 Security Analyst

CloudSEK L1 Security Analyst

Job Summary

We are looking for a CloudSEK L1 Security Analyst to join our Security Operations team. The candidate will be responsible for continuous security monitoring, alert triage, initial investigation, threat intelligence enrichment, identification of potential security threats, and timely escalation of confirmed or suspicious incidents to L2/L3 analysts.

The role requires a good understanding of Threat Intelligence, Digital Risk Protection, External Attack Surface Monitoring, phishing, credential exposure, malicious infrastructure, and IOC analysis, along with the ability to follow defined SOPs and playbooks in a 24×7 SOC environment.

Key Responsibilities

• Monitor security alerts and events generated through CloudSEK and other security monitoring platforms.
• Perform initial L1 alert triage and analysis based on defined SOPs, playbooks, and escalation procedures.
• Validate and categorize alerts as True Positive, False Positive, or Benign/Informational.
• Monitor and investigate alerts related to:
  • Phishing and malicious URLs
  • Brand impersonation
  • Look-alike and typosquatting domains
  • Compromised credentials
  • Credential leaks
  • Data exposure
  • Malicious IP addresses and domains
  • Vulnerabilities and exposed services
  • External attack surface exposure
  • Threat actor infrastructure
  • Dark Web / Deep Web indicators
• Perform initial investigation of suspicious domains, URLs, IP addresses, email addresses, credentials, hashes, and other IOCs.
• Enrich IOCs using available threat intelligence sources and determine their relevance and risk.
• Investigate suspicious websites, phishing pages, domains, and brand impersonation attempts.
• Monitor externally exposed assets, domains, applications, services, and technologies for potential security risks.
• Correlate alerts with available SIEM, EDR/XDR, firewall, WAF, email security, and vulnerability management data where required.
• Perform basic analysis of threat intelligence and identify relationships between IOCs, infrastructure, vulnerabilities, and threat activity.
• Identify potential security incidents and escalate confirmed or suspicious cases to L2/L3 analysts with complete investigation details.
• Collect and document relevant evidence and IOCs, including:
  • IP addresses
  • Domains
  • URLs
  • File hashes
  • Email addresses
  • Usernames
  • Compromised credentials
  • Affected assets
• Perform basic investigation using MITRE ATT&CK techniques and known attack patterns where applicable.
• Follow defined incident response procedures, severity classifications, escalation matrices, and SLAs.
• Maintain accurate incident tickets, investigation notes, evidence, and shift handover reports.
• Support L2 analysts by providing complete initial investigation findings and relevant enrichment.
• Monitor threat intelligence feeds and identify threats relevant to the monitored environment.
• Identify repetitive alerts and recurring threat patterns and highlight them to L2 for further analysis and tuning.
• Participate in IOC-based threat hunting activities under L2/L3 guidance.
• Maintain awareness of emerging threats, vulnerabilities, phishing campaigns, threat actors, and attack techniques.
• Participate in continuous improvement of SOC processes, SOPs, and knowledge base.

Required Skills

• 1-3 years of experience in SOC, Security Monitoring, Cybersecurity Operations, Threat Intelligence, or a related role.
• Hands-on exposure to SIEM platforms such as Splunk, Microsoft Sentinel, QRadar, ArcSight, or equivalent.
• Basic experience with EDR/XDR platforms.
• Good understanding of:
  • TCP/IP and networking fundamentals
  • DNS
  • HTTP/HTTPS
  • Firewalls and WAF
  • Proxy technologies
  • Windows and Linux security fundamentals
  • Authentication and access management
• Basic understanding of Threat Intelligence and IOC analysis.
• Ability to investigate and analyze:
  • Phishing
  • Malicious URLs
  • Suspicious domains
  • Credential compromise
  • Malware indicators
  • Malicious IP addresses
  • Data exposure
  • Vulnerabilities
  • External attack activity
• Basic understanding of MITRE ATT&CK and common attack techniques.
• Ability to perform basic IOC enrichment using threat intelligence sources.
• Ability to follow SOPs, playbooks, escalation procedures, and defined SLAs.
• Good analytical, communication, documentation, and incident-handling skills.
• Ability to work effectively in a 24×7 SOC environment.

Good to Have

• Hands-on exposure to CloudSEK or similar Threat Intelligence / Digital Risk Protection platforms.
• Exposure to Attack Surface Management (ASM/EASM).
• Exposure to Digital Risk Protection (DRP).
• Experience with Dark Web / Deep Web monitoring.
• Exposure to credential leak and data leak monitoring.
• Knowledge of phishing, brand impersonation, typosquatting, and malicious domain analysis.
• Exposure to Threat Hunting and IOC-based hunting.
• Exposure to SOAR and security automation.
• Basic scripting knowledge in Python, PowerShell, or Bash.
• Basic understanding of vulnerability management and CVE analysis.
• Certifications such as Security+, CEH, CySA+, SC-200, or equivalent.
• Experience handling phishing, malware, credential compromise, and external threat alerts.

Key Sourcing Keywords

CloudSEK | SOC L1 | Threat Intelligence | Cyber Threat Intelligence | Digital Risk Protection | DRP | External Attack Surface Management | EASM | Attack Surface Management | ASM | Dark Web | Credential Leak | Data Leak | Phishing | Brand Protection | Brand Impersonation | Typosquatting | IOC Analysis | Threat Monitoring | SIEM | EDR/XDR

Experience

1-3 years relevant cybersecurity/SOC experience.

Shift

24×7 rotational shift environment