Security Operations Center Analyst
The work spans detection, response, identity, and email. My role supports small and mid-sized organizations through a managed services model.
A typical month brings 100+ events across endpoint, identity, network, and email queues. The hard part isn't the volume. It's deciding quickly whether each alert is a true positive worth chasing or a tuning problem worth fixing. After working with the IT teams I support to retune the noisy rules, false-positive volume on those rules dropped about 40%.
Phishing analysis follows the same path each time. Pull the headers, walk the SPF, DKIM, and DMARC chain, then evaluate the link or payload in a clean environment to determine what was delivered and to whom. The last step is writing a response that closes the ticket for the user and gives the IT team an artifact they can use later.
When an investigation outgrows the SIEM, I move into a dedicated Linux VM and work the open-source angle. That includes infrastructure analysis, indicator collection, and attribution leads. The clean environment isn't about paranoia. It keeps me from contaminating evidence or burning sources by browsing from a logged-in workstation.
Endpoint protection is where most incidents start and most resolutions land. The work involves isolation, investigation, and remediation. Identity sits on the other side of the same conversation, covering access, conditional access posture, MFA enforcement, and the audit trail. I work both sides daily.
The SOCs that run well operate from playbooks the analysts actually use. I write the docs as I go, including investigation walkthroughs, tuning rationale, and customer-facing language for common incident types. Tier 1 and 2 customer satisfaction holds at A+ partly because the team isn't reinventing the wheel on every ticket.