SOC Analyst I

Sherwood Design Engineers•San Jose, CA

About The Position

The SOC Analyst I is an entry-level cybersecurity professional and the first line of defense within the Security Operations Center. The role monitors, triages, and investigates security alerts across organizational security platforms, performs initial incident analysis, escalates potential threats, and assists with incident response activities. The analyst works closely with senior analysts, engineers, and IT teams to protect organizational assets and improve security operations. Responsibilities include monitoring and validating alerts from Microsoft Defender XDR, Microsoft Sentinel, and other security tools; investigating common threats; supporting incident response; analyzing security logs and correlating information across data sources; performing basic investigations and KQL queries; assisting with IOC searches and threat hunting; and documenting incidents, findings, and remediation activities.

Requirements

Understanding of cybersecurity fundamentals, including Confidentiality, Integrity, and Availability (CIA), the attack lifecycle, phishing and social engineering attacks, and the MITRE ATT&CK Framework.
Basic networking knowledge, including TCP/IP, DNS, DHCP, and HTTP/HTTPS.
Basic Windows operating system knowledge.
Familiarity with Microsoft 365 and cloud security concepts.
Experience or exposure to Microsoft Defender XDR, Microsoft Defender for Endpoint, Microsoft Sentinel, Microsoft Entra ID, Microsoft Intune, and SIEM/EDR technologies.
Analytical and problem-solving skills.
Strong attention to detail and ability to follow established procedures.
Ability to work in a fast-paced security environment.
Strong written and verbal communication skills.

Nice To Haves

CompTIA Security+ certification.
Microsoft SC-900 certification.
Microsoft SC-200 certification or active pursuit of the certification.
Microsoft AZ-900 certification.
ISC2 Certified in Cybersecurity (CC) certification.

Responsibilities

Monitor security alerts and incidents generated by Microsoft Defender XDR, Microsoft Sentinel, and other security tools.
Perform initial triage and validation of security events.
Investigate common threats, including phishing, malware, unauthorized access attempts, and suspicious user activity.
Escalate high-risk or complex incidents to senior analysts.
Assist with identifying, containing, and documenting security incidents.
Collect and analyze evidence from endpoints, identity systems, email security tools, and cloud environments.
Follow established incident response procedures and playbooks.
Review and analyze Windows Event Logs, Microsoft Entra ID sign-in logs, Microsoft 365 audit logs, Microsoft Defender telemetry, network logs, and firewall logs.
Correlate information across multiple data sources to identify potential threats.
Review Microsoft Defender XDR alerts and perform basic investigations using Microsoft Sentinel.
Execute basic KQL queries for incident analysis and assist with security monitoring and detection validation.
Search for Indicators of Compromise (IOCs), review threat intelligence provided by the security team, and assist with basic threat hunting.
Maintain accurate incident records and case notes.
Document investigative findings and remediation activities.
Contribute to knowledge base articles and operational procedures.