{"id":3858663,"url":"https://alion.io/job/sisa-cloudsek-l1-security-analyst","title":"CloudSEK L1 Security Analyst","company":{"id":2144267,"name":"SISA","domain":"sisa.ai","url":"https://alion.io/company/sisa-ai","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Keka","truth_index":{"grade":"B","score":75,"open_postings":12,"ghost_share":0,"stale_share":1,"repost_share":0,"time_to_fill_p50_days":null,"computed_at":"2026-11-08T05:47:12Z"}},"role":"Security","role_family":"Security","seniority":"junior","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Bengaluru, India"],"countries":["IN"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":1,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"DNS","optional":false},{"name":"IBM QRadar","optional":false},{"name":"Linux","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"SIEM","optional":false},{"name":"Splunk","optional":false},{"name":"TCP/IP","optional":false},{"name":"Windows","optional":false},{"name":"Bash","optional":true},{"name":"CVE","optional":true},{"name":"PowerShell","optional":true},{"name":"Python","optional":true}],"status":"live","first_seen_at":"2026-11-06T05:46:07Z","employer_posted_date":"2026-11-06","last_verified_at":"2026-11-08T03:06:00Z","board_verified":true,"closed_at":null,"days_open":2,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":2},"description":"CloudSEK L1 Security Analyst\nJob Summary\nWe are looking for a CloudSEK L1 Security Analyst to join our Security Operations team. The candidate will be responsible for continuous security monitoring, alert triage, initial investigation, threat intelligence enrichment, identification of potential security threats, and timely escalation of confirmed or suspicious incidents to L2/L3 analysts.\nThe role requires a good understanding of Threat Intelligence, Digital Risk Protection, External Attack Surface Monitoring, phishing, credential exposure, malicious infrastructure, and IOC analysis, along with the ability to follow defined SOPs and playbooks in a 24×7 SOC environment.\nKey Responsibilities\nMonitor security alerts and events generated through CloudSEK and other security monitoring platforms.\nPerform initial L1 alert triage and analysis based on defined SOPs, playbooks, and escalation procedures.\nValidate and categorize alerts as True Positive, False Positive, or Benign/Informational.\nMonitor and investigate alerts related to:Phishing and malicious URLs\nBrand impersonation\nLook-alike and typosquatting domains\nCompromised credentials\nCredential leaks\nData exposure\nMalicious IP addresses and domains\nVulnerabilities and exposed services\nExternal attack surface exposure\nThreat actor infrastructure\nDark Web / Deep Web indicators\n\nPerform initial investigation of suspicious domains, URLs, IP addresses, email addresses, credentials, hashes, and other IOCs.\nEnrich IOCs using available threat intelligence sources and determine their relevance and risk.\nInvestigate suspicious websites, phishing pages, domains, and brand impersonation attempts.\nMonitor externally exposed assets, domains, applications, services, and technologies for potential security risks.\nCorrelate alerts with available SIEM, EDR/XDR, firewall, WAF, email security, and vulnerability management data where required.\nPerform basic analysis of threat intelligence and identify relationships between IOCs, infrastructure, vulnerabilities, and threat activity.\nIdentify potential security incidents and escalate confirmed or suspicious cases to L2/L3 analysts with complete investigation details.\nCollect and document relevant evidence and IOCs, including:IP addresses\nDomains\nURLs\nFile hashes\nEmail addresses\nUsernames\nCompromised credentials\nAffected assets\n\nPerform basic investigation using MITRE ATT&CK techniques and known attack patterns where applicable.\nFollow defined incident response procedures, severity classifications, escalation matrices, and SLAs.\nMaintain accurate incident tickets, investigation notes, evidence, and shift handover reports.\nSupport L2 analysts by providing complete initial investigation findings and relevant enrichment.\nMonitor threat intelligence feeds and identify threats relevant to the monitored environment.\nIdentify repetitive alerts and recurring threat patterns and highlight them to L2 for further analysis and tuning.\nParticipate in IOC-based threat hunting activities under L2/L3 guidance.\nMaintain awareness of emerging threats, vulnerabilities, phishing campaigns, threat actors, and attack techniques.\nParticipate in continuous improvement of SOC processes, SOPs, and knowledge base.\nRequired Skills\n1-3 years of experience in SOC, Security Monitoring, Cybersecurity Operations, Threat Intelligence, or a related role.\nHands-on exposure to SIEM platforms such as Splunk, Microsoft Sentinel, QRadar, ArcSight, or equivalent.\nBasic experience with EDR/XDR platforms.\nGood understanding of:TCP/IP and networking fundamentals\nDNS\nHTTP/HTTPS\nFirewalls and WAF\nProxy technologies\nWindows and Linux security fundamentals\nAuthentication and access management\n\nBasic understanding of Threat Intelligence and IOC analysis.\nAbility to investigate and analyze:Phishing\nMalicious URLs\nSuspicious domains\nCredential compromise\nMalware indicators\nMalicious IP addresses\nData exposure\nVulnerabilities\nExternal attack activity\n\nBasic understanding of MITRE ATT&CK and common attack techniques.\nAbility to perform basic IOC enrichment using threat intelligence sources.\nAbility to follow SOPs, playbooks, escalation procedures, and defined SLAs.\nGood analytical, communication, documentation, and incident-handling skills.\nAbility to work effectively in a 24×7 SOC environment.\nGood to Have\nHands-on exposure to CloudSEK or similar Threat Intelligence / Digital Risk Protection platforms.\nExposure to Attack Surface Management (ASM/EASM).\nExposure to Digital Risk Protection (DRP).\nExperience with Dark Web / Deep Web monitoring.\nExposure to credential leak and data leak monitoring.\nKnowledge of phishing, brand impersonation, typosquatting, and malicious domain analysis.\nExposure to Threat Hunting and IOC-based hunting.\nExposure to SOAR and security automation.\nBasic scripting knowledge in Python, PowerShell, or Bash.\nBasic understanding of vulnerability management and CVE analysis.\nCertifications such as Security+, CEH, CySA+, SC-200, or equivalent.\nExperience handling phishing, malware, credential compromise, and external threat alerts.\nKey Sourcing Keywords\nCloudSEK | SOC L1 | Threat Intelligence | Cyber Threat Intelligence | Digital Risk Protection | DRP | External Attack Surface Management | EASM | Attack Surface Management | ASM | Dark Web | Credential Leak | Data Leak | Phishing | Brand Protection | Brand Impersonation | Typosquatting | IOC Analysis | Threat Monitoring | SIEM | EDR/XDR\nExperience\n1-3 years relevant cybersecurity/SOC experience.\nShift\n24×7 rotational shift environment","description_format":"text","description_chars":5527,"description_truncated":false,"requirements":{"experience_years_min":1,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Artificial Intelligence","Cybersecurity","Information Security"],"lifecycle":[{"event":"open","at":"2026-11-06T07:59:35Z"}],"visa":[],"liveness":{"score":63,"band":"ok","label":"Likely open","p_open":1,"p_active":0.632,"p_room":1,"age_days":2,"expected_fill_days":29,"reasons":["conf:2","stale_co","velocity","win:early","comp:junior"],"computed_at":"2026-11-08T05:47:12Z"},"pay":null,"html_url":"https://alion.io/job/sisa-cloudsek-l1-security-analyst","json_url":"https://alion.io/job/sisa-cloudsek-l1-security-analyst.json","meta":{"generated_at":"2026-11-08T06:11:24Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":13447,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-09T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":2144267},"rest":"https://alion.io/mcp/rest/get_company?id=2144267"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fsisa-cloudsek-l1-security-analyst"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fsisa-cloudsek-l1-security-analyst"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fsisa-cloudsek-l1-security-analyst"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/sisa-cloudsek-l1-security-analyst\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fsisa-cloudsek-l1-security-analyst"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3858663}},{"tool":"search_jobs","arguments":{"company":"sisa.ai","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3858663},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}