L1.0 — SOC Associate Analyst

L1.0 — SOC Associate Analyst

Role Purpose

The SOC Associate Analyst provides supervised security monitoring and alert triage. The role focuses on operational discipline, accurate classification, playbook execution, evidence capture and timely escalation.

This is a foundational role, allowing sufficient time to build technical capability across networks, endpoints, identity, cloud and the SOC toolset.

Key Responsibilities

• Monitor Microsoft Sentinel, Microsoft Defender XDR, Cortex XSIAM or equivalent platforms.

• Review and acknowledge alerts within contractual SLAs.

• Validate alert entities, including:

• Users.

• Endpoints.

• IP addresses.

• Cloud resources.

• Applications.

• Email messages.

• Execute approved investigation playbooks.

• Identify known benign activity, duplicates and obvious false positives.

• Perform initial phishing and suspicious email checks.

• Review basic endpoint process and account activity.

• Capture investigation evidence in the case management platform.

• Escalate suspicious, high-risk or inconclusive activity.

• Maintain accurate ticket categorisation and customer-specific records.

• Participate in shift handovers and daily operational reviews.

• Complete assigned training, laboratories and certification objectives.

Experience

• 1–2 years of cybersecurity or relevant IT experience.

• Previous service desk, NOC, desktop or cloud-support experience is advantageous.

• Works under close or routine supervision during the initial development period.

• Expected to become independently competent in common alert types by the end of the tier.

Required Technical Knowledge

• Basic Windows, Linux and Microsoft 365 knowledge.

• Basic Azure cloud concepts.

• Basic Entra ID concepts:

• Users and groups.

• Authentication.

• Multifactor authentication.

• Sign-in logs.

• Conditional Access awareness.

• Basic networking:

• TCP/IP.

• DNS.

• HTTP/HTTPS.

• VPN.

• Firewalls.

• Common ports and protocols.

• Basic understanding of phishing, malware, brute force, suspicious sign-ins and endpoint detections.

• Basic Microsoft Defender, Sentinel and XSIAM navigation.

Qualification Alignment

Required or Target

• Computer Science / computing Degree

• Cisco CCNA

• CompTIA A+ or equivalent experience.

• Microsoft SC-900.

• Microsoft AZ-900.

• Palo Alto Cortex XSIAM foundation training.

• Internal SOC Analyst Foundation certification.

Desirable During the Tier

• CompTIA Network+.

• CompTIA Security+.

• Microsoft SC-200 learning pathway.

Performance Requirements

• Minimum 95% SLA adherence.

• Minimum 85% sustained QA score.

• Accurate ticket classification and complete evidence capture.

• No repeated missed critical escalations.

• Consistent shift attendance and handover quality.

• Demonstrated improvement in first-line investigative capability.

• Completion of the 24-month development plan and promotion assessment.