InfoSec L1 SOC Analyst

Overview

Support day-to-day monitoring, triage and investigation of security alerts across Zoetis as an L1 SOC Analyst within the global 24/7/365 security operations team at the Zoetis India Capability Center in Hyderabad.

What you'll do

• Partner with onshore SOC and incident response teams to triage, escalate and assist in the investigation of endpoint-related alerts using CrowdStrike EDR and SIEM.
• Analyze and interpret SIEM detections and endpoint telemetry to understand alert context, assess severity and support appropriate response actions.
• Contribute feedback on alert fidelity by documenting false positives, missed detections and behavioral anomalies encountered during investigations.
• Support efforts to improve endpoint visibility by assisting with sensor health checks, basic policy verification and telemetry validation activities.
• Participate in investigations of suspicious activity by gathering relevant data from EDR, SIEM and threat intelligence sources to aid in root cause analysis.
• Collaborate with senior analysts and cross-functional teams such as Threat Intel, Vulnerability Management, OT and Incident Response to contextualize alerts and broaden investigative scope.
• Assist in reviewing and updating incident response playbooks and SOPs to ensure alignment with current tools and team workflows.
• Follow established escalation procedures, documenting investigative steps clearly and contributing to knowledge sharing within the team.
• Help monitor the effectiveness of detections and response actions by tracking alert trends and contributing to internal metrics and reporting.
• Stay informed on emerging threats, attacker behaviors and security platform updates to continue building knowledge and improving investigation skills.

What you'll need

• University degree in Computer Science or Information Systems.
• Minimum of 2+ years of relevant experience with a strong background in security operations, CrowdStrike EDR, threat intelligence and security engineering.
• 1+ years of experience in the pharmaceutical or other regulated industry, especially Animal Health.
• Experience working with global teams across multiple time zones.
• Demonstrated ability to work within diverse technical teams.
• Working knowledge of security technologies such as EDR (CrowdStrike), SIEM platforms and basic exposure to threat intelligence and detection concepts.
• Basic familiarity with scripting or automation using Python, PowerShell, or Bash to support investigation workflows and alert enrichment.
• Exposure to cloud platforms (AWS, Azure, GCP) and a general understanding of cloud security fundamentals relevant to monitoring and response.
• Foundational understanding of network security principles, including firewalls, IDS/IPS, VPNs and modern access models like zero-trust.
• Experience working with or exposure to identity and access management (IAM) solutions such as Azure AD, Secret Server, or SailPoint in a security operations context.
• Understanding of core incident response processes, basic threat detection workflows and the role of vulnerability management in SOC operations.
• Awareness of encryption technologies, secure communication protocols and security best practices relevant to threat detection.
• Strong analytical thinking and the ability to interpret alert data, logs and telemetry to identify unusual patterns or behaviors.
• Familiarity with security compliance standards (e.g., GDPR, HIPAA, PCI DSS) and how they relate to incident documentation and escalation.
• Clear and professional communication skills, with the ability to document investigations and contribute effectively within a global security team.
• Flexibility to participate in a rotating shift schedule that includes day shifts, night shifts, and overnight shifts to support 24x7 operations.
• Flexibility to provide off-hours escalation support for high-priority incidents (P1, P2) as needed.

Nice to have

• MS or advanced identity courses or other applicable certifications.
• Certified Information Systems Security Professional (CISSP).
• Relevant certifications in infrastructure security and vulnerability management, such as SANS GCIH or Offensive Security Certified Professional (OSCP), are highly preferred.

Details

• Location: Hyderabad, India (Zoetis India Capability Center).
• Employment type: Full time.
• Rotating shift schedule including day, night and overnight shifts, plus off-hours escalation support as needed.