Security Analyst @Atos

Key Responsibilities

Monitoring & Detection

• Monitor security alerts and events from multiple sources (SIEM, EDR, firewalls, IDS/IPS, email security tools, etc.)
• Identify potential security incidents through alert analysis and correlation
• Perform initial triage to determine severity and impact

Incident Triage & Response

• Investigate alerts to distinguish between true positives and false positives
• Follow predefined playbooks and runbooks for incident response
• Escalate confirmed or suspicious incidents to SOC L2/L3 teams
• Document all findings, actions, and decisions in the ticketing system

Threat Analysis Support

• Perform basic threat intelligence checks (IP reputation, domain analysis, file hashes)
• Enrich alerts with contextual information
• Assist in identifying patterns or recurring security issues

Operational Tasks

• Maintain and update incident tickets accurately
• Participate in shift handovers and report key incidents
• Ensure SLAs for alert handling and escalation are met
• Support continuous improvement by providing feedback on detection rules

Required Skills & Qualifications

Technical Skills

• Basic understanding of:
  • Networking (TCP/IP, DNS, HTTP/S)
  • Operating systems (Windows, Linux basics)
  • Cybersecurity concepts (malware, phishing, brute force, lateral movement)
• Familiarity with:
  • SIEM tools (e.g., Microsoft Sentinel, GoogleSecOps, Elastic, Splunk, QRadar)
  • Endpoint security solutions (e.g., Defender for Endpoint)
  • Log analysis

Analytical Skills

• Strong attention to detail and investigative mindset
• Ability to follow structured processes and playbooks
• Good decision-making under pressure

Soft Skills

• Strong written and verbal communication
• Ability to work in shifts (including nights/weekends if applicable)
• Team player with a proactive attitude

• 0–2 years of experience in cybersecurity or IT operations
• Relevant certifications (nice to have):
  • CompTIA Security+
  • SC-200 (Microsoft Security Operations Analyst)
  • CEH (Certified Ethical Hacker) – basic level

• Exposure to:
  • SIEM platforms (especially Microsoft Sentinel if in M365 environment)
  • Incident response processes
  • Threat intelligence tools

Key Metrics / KPIs

• Alert triage time
• Incident escalation quality
• SLA adherence
• False positive vs. true positive accuracy
• Documentation completeness

• 24/7 SOC environment (shift-based work required)
• High-pressure, fast-paced incident response scenarios
• Collaboration with global SOC teams and stakeholders