SOC Analyst

Understand how a SOC functions as a system, master the 7-step triage workflow, and develop the cognitive hygiene needed to sustain accuracy on a high-volume alert queue.

Execute end-to-end investigations across the four highest-volume alert classes and produce written dispositions that meet L2 quality standards.

Analyze any submitted email to classify and triage phishing, BEC, AiTM, and spear-phishing — and write a containment ticket that security engineering can act on immediately.

Parse Zeek logs, Suricata alerts, and flow data to investigate C2 beaconing, data exfiltration, lateral movement, and DNS anomalies — and write network-layer containment actions.

Own the full SOC output lifecycle — from alert to incident ticket to stakeholder report to lessons-learned — and understand where SOAR automation fits and what it can't replace.