SOC Engineer L1

Key Responsibilities:

Monitor security events and alerts 24/7 using SIEM and other security monitoring platforms.

Perform initial triage and investigation of security alerts to determine potential threats.

Analyze and distinguish between false positives and real security incidents.

Escalate validated incidents to SOC Level 2/Level 3 teams when necessary based on escalation procedures.

Perform basic incident containment actions following established incident response procedures.

Document incidents, maintain ticket updates, report and ensure proper record keeping in the ticketing system.

Follow incident handling SOPs and ensure response activities meet defined SLA requirements.

Track and follow up on incidents to ensure timely resolution and closure.

Intensively cooperate with L2, Regulator and End User to follow-up incident handling.

Facilitate online collaboration (Teams / Zoom) with others party if critical incident happens.

Requirements:

Bachelor’s Degree in Computer Science, Cybersecurity, Information Technology, or a related field.

Basic knowledge of cybersecurity concepts, including SIEM, Firewall, IDS/IPS, WAF, VPN, and EDR.

Ability to perform basic alert triage, log analysis, and incident documentation.

Strong analytical and problem-solving skills with attention to detail.

Good communication skills and a customer-oriented approach.

Willingness to work in a shift-based environment to support 24/7 security monitoring.