Security Operations & Incident Response Analyst

Description:

abra professional services is seeking a Security Operations & Incident Response Analyst!

Job Description:

Responsible for handling information security incidents escalated by an external 24/7 SOC team, conducting in-depth investigations, classifying incidents, and coordinating response activities with Infrastructure, Information Security, and Incident Response teams.

Key Responsibilities:

• Receive security alerts and incidents from an external SOC team, analyze them, and classify them based on severity and urgency.
• Investigate cybersecurity incidents using SIEM, EDR/XDR, logs, and infrastructure systems.
• Identify and classify false-positive alerts based on findings and supporting evidence.
• Coordinate and lead the operational handling of security incidents with IT and Incident Response teams.
• Perform or coordinate containment, remediation, and security hardening activities following security incidents.
• Analyze anomalous activity across Windows, Active Directory, network, and enterprise environments.
• Work with the SOC provider to improve detection rules, alert quality, and false-positive reduction.
• Document security incidents, prepare investigation reports, and track remediation activities.
• Participate in proactive Threat Hunting activities to identify suspicious behavior.

Mandatory Requirements:

• 2–4 years of experience in SOC operations, security incident investigation, or Incident Response.
• Hands-on experience investigating security incidents and analyzing logs.
• Experience working with SIEM and EDR/XDR solutions.
• Good knowledge of Windows environments and Active Directory.
• Strong independent investigation and analytical skills, with the ability to collaborate effectively across multiple teams.

Advantages:

• Experience investigating incidents at a SOC Tier 2 level.
• Experience working with an external SOC team/provider.
• Experience with Microsoft Defender, Microsoft Sentinel, Trend AI, or similar security solutions.
• Familiarity with Microsoft 365 and Entra ID.
• Experience with Incident Response and Threat Hunting processes.