As a Tier 1 Security Operations Support Agent, you will serve as the first line of defense in the Capability-Oriented Monitoring model. You are responsible for the initial triage and validation of security alerts, ensuring that the environment remains secure while minimizing noise for system owners. You will work closely with our automated systems to identify true/false positives, apply initial containment measures, and act as a critical escalation point when high-severity threats are detected.

Your Responsibilities 

• Automated Triage & Validation:

• Execute first-level triage on security alerts triggered by our centralized SIEM (Google SecOps). Validate true/false positives and apply initial containment actions (e.g., isolating containers, locking service accounts) using established playbooks. 

• Incident Response Support: Assist the SOC team during high-severity incidents by providing initial investigative data, helping with containment, and documenting actions in our incident management platform (FireHydrant). 

• Operational Health Monitoring:Use Capability Dashboards to monitor the security health of your assigned service areas, identifying and reporting on potential policy drifts or misconfigurations. 

• Playbook Management: Assist in the ongoing maintenance and optimization of automated response playbooks. Help identify gaps in current detections and contribute feedback to the SOC engineering team for continuous improvement. 

• Collaboration & Communication:Act as a bridge between the SOC and system owners. Communicate findings clearly, provide contextual assistance for Tier 2/3 escalations, and participate in post-incident reviews to drive long-term resilience. 

• Knowledge Sharing: Create and maintain documentation for common alert types, triage workflows, and escalation procedures to promote operational consistency and efficiency. 

Requirements 

• Experience: 1+ years of experience in IT, Security Operations, Help Desk, or a similar technical support role. 

• Technical Troubleshooting: Strong analytical skills with experience troubleshooting hardware, software, and access issues. 

• Security Mindset: Understanding of core security concepts, including IAM, endpoint protection, and the OSI model. Familiarity with SIEM/SOAR platforms (e.g., Google SecOps) is a plus. 

• Communication: Ability to communicate complex security concepts simply and concisely, especially when coordinating with system owners or during incident response. 

• Problem Solving: A keen ability to multitask, apply critical thinking to triage, and solve problems under pressure. 

• Collaborative Spirit: You value shared accountability, attention to detail, and a team-oriented approach to security. 

Nice to Haves 

• Experience with cloud environments (GCP preferred) and infrastructure-as-code principles. 

• Familiarity with scripting (e.g., Python, Bash) or detection-as-code workflows. 

• Experience with common security tools like CrowdStrike Falcon, Okta, or Zscaler. 

• Understanding of retail-specific security threats and compliance standards (e.g., PCI-DSS).