Security Operations Center Analyst

As a SOC Analyst, you will serve as a first responder to cybersecurity threats, helping protect IBM's global enterprise by identifying, investigating, and containing malicious activity before it becomes a significant incident.

You will work closely with threat detection engineers, incident responders, security operations teams, and business stakeholders to assess security alerts, determine risk and impact, and take appropriate response actions.

This role requires strong investigative instincts, technical troubleshooting skills, and the ability to communicate findings clearly to both technical and non-technical audiences.

Key Responsibilities

• Monitor and investigate security alerts generated from SIEM, EDR, email security, cloud security, and network security platforms
• Perform triage and analysis of security events to determine legitimacy, severity, scope, and impact
• Execute approved containment actions, including host isolation, account restrictions, malicious email remediation, and blocking indicators of compromise
• Escalate confirmed or high-risk incidents while providing complete investigative context and supporting evidence
• Analyze endpoint, network, identity, cloud, and application telemetry to identify malicious activity
• Correlate data from multiple security technologies to investigate complex security events
• Document investigations, containment actions, and recommendations in accordance with operational procedures
• Participate in incident response activities and support post-incident reviews as needed
• Continuously improve detection and triage processes through operational feedback and collaboration with engineering teams
• Maintain awareness of emerging threats, attacker tactics, techniques, and procedures (TTPs), and industry trends
• Contribute to operational readiness by assisting with playbook development, process improvement, and knowledge sharing