Tier 1 NOC/SOC Analyst

Role Summary

The Tier 1 NOC/SOC Analyst serves as the first line of defense in monitoring, detecting, and responding to network and security events. This role is responsible for continuous monitoring of infrastructure and security systems, initial triage of alerts, and escalation of incidents according to established procedures. The ideal candidate is detail-oriented, thrives in a fast-paced environment, and is eager to develop a career in IT operations or cybersecurity.

Key Responsibilities

• Monitor network infrastructure, security information and event management (SIEM) tools, and alerting dashboards on a 24x7x365 basis.
• Perform initial triage of security alerts, network anomalies, and system alarms; classify and prioritize incidents in accordance with defined severity levels.
• Create, update, and close incident tickets in the ticketing system with accurate documentation of actions taken.
• Escalate unresolved or high-severity incidents to Tier 2/3 analysts or engineering teams following established runbooks and escalation procedures.
• Conduct basic troubleshooting of network connectivity issues, VPN failures, server outages, and device health alerts.
• Execute defined response playbooks for common threat types including phishing, malware alerts, and brute-force attempts.
• Perform routine health checks on network devices, servers, and security appliances.
• Assist in maintaining SOC/NOC documentation, runbooks, and standard operating procedures.
• Participate in shift handover briefings, communicating open issues and ongoing incidents to relieve analysts.
• Support compliance monitoring and log review activities as directed.

Required Qualifications

• Associate’s or bachelor’s degree in information technology, Cybersecurity, Computer Science, or a related field — or equivalent hands-on experience.
• 0–2 years of experience in a NOC, SOC, help desk, or IT operations role.
• Fundamental understanding of TCP/IP networking, OSI model, DNS, DHCP, and common network protocols.
• Familiarity with Windows and Linux operating systems.
• Ability to read and interpret basic log data from firewalls, routers, switches, and endpoint tools.
• Strong attention to detail and ability to manage multiple open issues simultaneously.
• Clear verbal and written communication skills for documenting and escalating incidents.
• Availability to work rotating shifts, including nights, weekends, and holidays.

Preferred Qualifications

• CompTIA Security+, Network+, or equivalent certification (or active pursuit).
• Hands-on experience with SIEM platforms such as Splunk, IBM QRadar, or Microsoft Sentinel.
• Exposure to ticketing systems such as ServiceNow, Jira, or Remedy.
• Familiarity with IDS/IPS, endpoint detection and response (EDR), or vulnerability management tools.
• Experience with scripting (Python, Bash, or PowerShell) for basic automation or log parsing.
• Understanding of MITRE ATT&CK framework and common threat actor TTPs.

Tools & Technologies

SIEM (Splunk / QRadar / Sentinel), EDR (CrowdStrike / Sentinel One), Firewall platforms (Palo Alto / Fortinet / Cisco), Network monitoring tools (SolarWinds / PRTG / Nagios), VPN platforms, Ticketing systems (ServiceNow / Jira), Microsoft 365, and Active Directory.

Work Environment

This position operates in a 24x7 operations center environment and requires shift flexibility. Analysts work within a team structure with clear escalation paths to senior engineers and management. Ongoing training and certification support are provided to encourage career growth within the NOC/SOC.