Job description

Job Title

SOC Analyst – Permanent Night Shift

About the role

We’re looking for a SOC Analyst for our permanent night shift in Hyderabad to focus on high‑quality alert triage and first‑line incident handling. You’ll work mainly with CrowdStrike Falcon, Microsoft Sentinel, and related security tools to keep our global environment safe while most of the company is asleep.

Experience

- 1–5 years in a SOC / security monitoring role (L1 or L1/L2 mix).
- Prior experience in a 24/7 or shift‑based SOC is a plus.

Shift details

- Location: Hyderabad.
- Permanent night shift, working with EMEA/US time zones.
- Participation in a rotation that may include weekends and holidays.
- Clear handover required at the end of each shift to the next region/shift.

Key responsibilities (Night Shift, triage‑focused)

- Monitor and triage security alerts from EDR/XDR (primarily CrowdStrike Falcon), SIEM (Microsoft Sentinel), and other security tools.
- Perform alert‑driven incident handling at L1/L1.5 level:
- Quickly review new detections,
- Decide whether to close as benign/false positive, investigate further, or escalate,
- Apply standard playbook‑based response actions where allowed (e.g. isolate host, block hash/domain, disable account with approval).
- For CrowdStrike Falcon in particular:
- Review detections, examine process trees and related activity,
- Validate severity and impact based on context,
- Close noise/false positives with clear justification or escalate meaningful events.
- Use Microsoft Sentinel and other platforms to pull additional context during triage (host history, user activity, geo/access patterns, related alerts).
- Analyze and respond to phishing alerts and user‑reported suspicious emails using defined playbooks (header analysis, URL/file sandboxing, user follow‑up, ticket updates).
- Review vulnerability scan results (e.g. Tenable) for basic risk context, confirm exposure where needed, and follow up with the relevant teams according to priority and SLAs.
- Conduct basic, playbook‑driven “mini threat hunting” during quieter periods (e.g. running saved queries/hunts in Sentinel and EDR to look for common attacker techniques or newly published IOCs).
- Keep tickets, incident records, and runbooks up to date with short, precise, and complete investigation notes (what triggered, what you checked, what you decided, and why).
- Produce clear shift‑end handover notes for open incidents and important observations.

What we’re looking for

Core SOC / triage skills

- 1–5 years of hands‑on SOC experience in monitoring, triage, and first‑line incident handling (L1 or L1/L2).
- Strong focus on alert triage rather than deep forensics: able to work through a queue efficiently, recognize patterns, and make clear decisions (close, investigate further, escalate).
- Experience with:
- At least one enterprise EDR/XDR platform (ideally CrowdStrike Falcon) for alert analysis and basic response (host isolation, hash/domain blocking, evidence collection).
- A SIEM platform (ideally Microsoft Sentinel) for correlating alerts and running queries to gather additional context.
- Good understanding of security fundamentals:
- Logs: endpoint, authentication, OS, and basic application logs.
- Endpoints: Windows and/or Linux basics, common processes and admin tools.
- Networks: TCP/IP basics, DNS, web traffic, VPN and remote access patterns.
- Common attack techniques across the kill chain (phishing, credential theft, lateral movement, malware execution, C2, data exfiltration).

Tools and platforms

- Familiarity with some of the following (or similar solutions):
- CrowdStrike Falcon or another modern EDR/XDR platform.
- Microsoft Sentinel or another SIEM (including experience running and understanding queries; KQL is a plus).
- Vulnerability management tools such as Tenable.
- Email security / anti‑phishing tools, sandboxing, or secure email gateways.

Ways of working and soft skills

- Comfortable working permanently in night shift and collaborating with global teams spread across regions.
- Strong written communication: able to document alerts, investigations, and handovers in clear, concise English.
- Ability to stay calm, structured, and pragmatic during active incidents and high‑alert periods.
- Habit of following runbooks and escalation paths, while also giving feedback when you see gaps or improvement opportunities.
- Ownership mindset: you close the loop on alerts you touch, or you hand them over with enough context that the next person can continue smoothly.

Nice to have

- Experience in a 24/7 SOC environment with strict SLAs.
- Hands‑on experience specifically with CrowdStrike Falcon and Microsoft Sentinel in a production environment.
- Exposure to SOAR / automation and working with automated playbooks for common use cases (phishing, malware, brute force, etc.).
- Familiarity with basic vulnerability prioritization (CVSS concepts, asset criticality).
- Security certifications such as:
- CompTIA Security+, CySA+,
- CEH,
- Vendor‑specific SOC/EDR/XDR certifications (including CrowdStrike, Microsoft, etc.).

Growth and development

Even though this role is centered on triage, we want people who are interested in growing further within the SOC. Over time, you’ll have opportunities to:

- Take on more complex investigations and incident response tasks under guidance from senior analysts.
- Get involved in improving detection rules, tuning alerts, and enhancing runbooks.
- Develop towards specialist tracks such as incident response, threat hunting, or detection engineering depending on your strengths and interests.

Someone shared one job with you. ASAI keeps finding the rest.

Scored, not searched. Every role ranked against your actual profile.

Alerts as often as hourly. Reach new roles while the pile is still small.

Skill gaps, spelled out. See exactly which requirements you don't meet yet.

Verified jobs, only. Say no to ghost jobs. Your time deserves respect.