Security Analyst [Tier 1]

Role Description

The Tier 1 Analyst is responsible for front-line security monitoring, initial alert triage, case creation, and first-level investigation of security events.

The Tier 1 Analyst ensures timely escalation based on severity, SLA, escalation matrix, and approved playbooks.

Responsibilities

Monitors SIEM, EDR/XDR, SOAR, case management, and other security platforms for security alerts and operational health indicators.

Performs initial triage, alert validation, severity classification, and false-positive identification.

Creates, updates, and maintains incident cases with relevant evidence, affected assets/users, timeline, severity, and initial analysis.

Escalates validated, high-priority, or suspicious incidents to agreed procedures.

Executes approved first-level actions defined in runbooks/playbooks and supports containment coordination when required.

Performs shift handover, case follow-up, and status updates to ensure monitoring continuity.

Reports log source health issues, monitoring gaps, alert noise, and platform anomalies

Contributes to knowledge base, operational runbooks, lessons learned, and continuous improvement feedback