Security Operations Center Analyst

What can you expect in a Security Operations Center Analyst role with TaskUs:

Our client's Security Operations Center (SOC) currently monitors approximately 65,000 global organizations, 2 million endpoints, and 3 million mailboxes/users from 3 SOC locations. The SOC Analyst 1 serves as an initial triage and alert review point for security events and alerts from our security tools. This role is responsible for conducting in-depth investigations, performing threat analysis, containing attacks, and assisting with improving detection capabilities.

Key Responsibilities:

• Investigate security alerts and suspicious activities from our client's own security stack, 3rd party tools, and cloud platforms.
• Perform detailed investigations into security alerts, attacker techniques, and identify emerging threats.
• Correlate events from multiple security tools and data sources to determine risk, business impact, and required remediation actions.
• Assist with developing and maintaining detection rules, use cases, playbooks, and response procedures.
• Validate security events and reduce false positives through tuning and optimization of monitoring tools.
• Assist with preparing post-event reports, executive summaries, and technical documentation.
• Stay current on threat intelligence, attacker tactics, techniques, and procedures (TTPs), and emerging cybersecurity trends.

Required Qualifications:

• At least 1 year of experience in a Security Operations Center, Incident Response, or Cybersecurity Analyst role.
• Experience investigating security events across endpoint, network, and cloud platforms.
• Strong understanding of cybersecurity frameworks such as NIST, MITRE ATT&CK, CIS Controls, and Cyber Kill Chain.
• Hands-on experience with SIEM platforms such as Microsoft Sentinel, Splunk, QRadar, or LogRhythm.
• Experience with endpoint detection and response (EDR) solutions such as Microsoft Defender for Endpoint, CrowdStrike, SentinelOne, or Carbon Black.
• Knowledge of networking protocols, operating systems, authentication technologies, and cloud security concepts.
• Strong analytical, troubleshooting, and problem-solving skills.
• Excellent written and verbal communication skills (you will be on customer calls).

Preferred Qualifications:

• Security certifications such as Security+, CySA+, GCIH, GCIA, GCFA, SC-200, CISSP, or equivalent.
• Experience with Microsoft security technologies including Defender XDR, Sentinel, Entra ID, and Microsoft 365 security solutions.
• Experience with scripting or automation using PowerShell, Python, KQL, or similar languages.
• Knowledge of digital forensics and incident response methodologies. Experience supporting cloud environments such as Azure, AWS, or Google Cloud Platform.

Success Measures:

• Timely identification and resolution of security incidents.
• Reduction of false-positive alerts through continuous tuning.
• Improvement of detection coverage and threat visibility.
• Contributions to security process improvements, team education, and operational maturity.

Education / Certifications:

• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or related field; equivalent experience may be considered.

Work Location / Work Schedule / Travel:

• Las Pinas office (Hiraya)
• 100% On-site Work setup
• 24x7 rotating-shift (rotate shifts every 4 to 6 weeks)