SOC Analyst I

Location: San Jose, Costa Rica

Position Summary The SOC Analyst I is an entry-level cybersecurity professional responsible for monitoring, triaging, and investigating security alerts across the organization's security platforms. This role serves as the first line of defense within the Security Operations Center (SOC), performing initial incident analysis, escalating potential threats, and assisting with incident response activities. The analyst will work closely with senior analysts, engineers, and IT teams to protect organizational assets and improve security operations.

Key Responsibilities

• Security Monitoring & Alert Triage:

  • Monitor security alerts and incidents generated by Microsoft Defender XDR, Microsoft Sentinel, and other security tools.

  • Perform initial triage and validation of security events.

  • Investigate common security threats, including phishing, malware, unauthorized access attempts, and suspicious user activity.

  • Escalate high-risk or complex incidents to senior analysts.

• Incident Response Support:

  • Assist in identifying, containing, and documenting security incidents.

  • Collect and analyze evidence from endpoints, identity systems, email security tools, and cloud environments.

  • Follow established incident response procedures and playbooks.

• Log Analysis:

  • Review and analyze Windows Event Logs, Microsoft Entra ID sign-in logs, Microsoft 365 audit logs, Microsoft Defender telemetry, network logs, and firewall logs.

  • Correlate information across multiple data sources to identify potential threats.

• Microsoft Security Operations:

  • Review alerts from Microsoft Defender XDR and perform basic investigations using Microsoft Sentinel.

  • Execute basic KQL queries for incident analysis and assist with security monitoring and detection validation.

• Threat Intelligence & Hunting:

  • Search for Indicators of Compromise (IOCs).

  • Review threat intelligence provided by the security team and assist in basic threat hunting activities.

• Documentation & Reporting:

  • Maintain accurate incident records and case notes.

  • Document investigative findings and remediation activities.

  • Contribute to knowledge base articles and operational procedures.

Required Qualifications & Skills

• Technical Knowledge:

  • Understanding of cybersecurity fundamentals (Confidentiality, Integrity, and Availability [CIA], attack lifecycle, phishing and social engineering attacks, MITRE ATT&CK Framework).

  • Basic networking knowledge (TCP/IP, DNS, DHCP, HTTP/HTTPS).

  • Basic Windows operating system knowledge.

  • Familiarity with Microsoft 365 and cloud security concepts.

• Security Tools: Experience or exposure to Microsoft Defender XDR, Microsoft Defender for Endpoint, Microsoft Sentinel, Microsoft Entra ID, Microsoft Intune, and SIEM/EDR technologies.

• Desired Skills: Analytical and problem-solving skills, strong attention to detail, ability to follow established procedures, ability to work in a fast-paced security environment, and strong written and verbal communication skills.

• Preferred Certifications: CompTIA Security+, Microsoft SC-900, Microsoft SC-200 (or actively pursuing), Microsoft AZ-900, or ISC2 Certified in Cybersecurity (CC).

• Role Logistics: Reports to the Security Operations Lead; categorized as an Entry-Level Security Operations Analyst (L1).