Security & Infrastructure Operations Centre (SIOC) Analyst
Core
Monitor, investigate, and respond to security incidents across cloud and enterprise environments, supporting DFIR activities.
Role type
SOC/SIOC Analyst (Incident Response & DFIR)
Builds
Security monitoring use cases, detection rules, and operational playbooks for customer environments
Domain
Cyber Security Operations, Cloud Security (AWS, Microsoft), Incident Response
Required skills
SIEM analysis, incident triage, log correlation, threat hunting, DFIR basics, cloud security monitoring, identity security, malware investigation, evidence collection, incident documentation
Preferred skills
DFIR specialization, threat intelligence analysis, scripting for automation, vulnerability management support
Technologies
Microsoft Sentinel, Microsoft Defender XDR/Endpoint/Cloud, Entra ID, AWS security services, EDR, SOAR, PowerShell, Python
Responsibilities
Monitor and investigate security alerts and suspicious activity; Triage alerts and determine severity and response actions; Investigate incidents across endpoints, identities, cloud, and networks; Support incident response from detection to recovery; Perform initial DFIR activities including evidence collection and timeline analysis; Escalate complex incidents; Document investigations and contribute to post-incident reviews; Improve detection rules and playbooks
Seniority
Mid-level, hands-on IC
