ROLE
– Detect, analyse, and respond to security threats to ensure the confidentiality, integrity, and availability of organizational systems
– Manage and integrate Microsoft Defender XDR, including Defender for End-point, Identity and Cloud Apps
– Onboard log sources including servers, applications, databases, network devices, and cloud platforms
– Configure and fine-tune correlation rules, alerts, dashboards, and reports
– Monitor security alerts, logs, and events on a 24×7 basis
– Identify, analyze, and triage security incidents and potential threats
– Escalate incidents as per defined incident response procedures
– Support security incident response activities including containment, eradication, and recovery
– Perform initial forensic analysis and collect evidence for investigations
– Document incidents, root cause analysis, and lessons learned
– Integrate threat intelligence feeds into SIEM platforms
– Develop, tune, and maintain SIEM use cases based on threat trends and risk assessments
– Generate security reports for management, audits, and compliance requirements
– Ensure log retention and monitoring meet regulatory and organizational requirements
– Integrate SIEM with SOAR, endpoint security, firewall, IDS/IPS, and cloud security tools
– Support automation of incident response workflows where applicable
– Work closely with IT, Network, Cloud, and Security teams
– Participate in vulnerability management and security improvement initiatives
– Stay updated on emerging threats, attack techniques, and security best practices

REQUIREMENTS
– Bachelor’s degree in Computer Science, Information Technology, Cyber Security, or a related field
– Microsoft AZ-500 Microsoft Defender certification
– IBM QRadar Certified Administrator certification
– ArcSight ESM Certification
– CompTIA Security+ or CySA+ certification
– Minimum of 2 years of experience
– Hands-on experience with SIEM platforms and SOC operations
– Strong knowledge of security logs, events, and alert analysis
– Understanding of networking, firewalls, IDS/IPS, and endpoint security
– Knowledge of MITRE ATT&CK framework and incident response processes
– Strong analytical, documentation, and communication skills