Cybersecurity Job Description Templates

About the role

[Company Name] is hiring a SOC Analyst I to monitor security alerts, perform first line triage, and escalate confirmed incidents. You will work alongside senior analysts and learn structured investigation practices in a live environment.

What you'll do

• Monitor alerts in [SIEM platform] and [EDR platform] during your assigned shift.
• Triage alerts, gather supporting evidence, and classify true and false positives.
• Document findings clearly in [ticketing system] and follow established playbooks.
• Escalate confirmed or ambiguous incidents to Tier 2 with a concise summary.
• Suggest detection and playbook improvements based on recurring alert patterns.

Required qualifications

• Understanding of TCP/IP, DNS, HTTP, and common network services.
• Familiarity with Windows and Linux logs and basic command line use.
• Ability to follow investigation playbooks and document work accurately.
• Clear written communication and willingness to work [shift pattern].

Preferred qualifications

• Hands on practice with a SIEM such as [SIEM platform].
• Certified CyberDefender Level 1 (CCDL1) is preferred for this role. Equivalent practical experience or relevant certifications will also be considered.
• Exposure to phishing analysis or malware triage in a lab or work setting.

About the role

[Company Name] is looking for an Incident Responder to investigate and contain security incidents across [environment, for example cloud, endpoints, OT]. You will lead technical response work and hand over clear findings to stakeholders.

What you'll do

• Lead technical investigation and containment for incidents of [severity levels].
• Collect and preserve evidence from endpoints, servers, and cloud services.
• Analyze host, memory, and network artifacts to reconstruct attacker activity.
• Coordinate remediation with IT, engineering, and [legal or compliance] partners.
• Write incident reports and post incident reviews with concrete follow up actions.
• Improve response playbooks and detection coverage after each engagement.

Required qualifications

• [X years] of experience responding to security incidents.
• Practical knowledge of Windows and Linux internals and common attacker techniques.
• Experience with [EDR platform] and [SIEM platform] during live investigations.
• Ability to preserve evidence and maintain a defensible chain of custody.

Preferred qualifications

• Certified CyberDefender Level 2 (CCDL2) is preferred where this role includes forensic analysis or threat hunting. Equivalent practical experience or relevant certifications will also be considered.
• Scripting in Python or PowerShell for evidence processing.
• Experience responding in [cloud provider] environments.

About the role

[Company Name] is hiring a Digital Forensics Analyst to examine digital evidence, answer investigative questions, and produce defensible documentation for technical and non technical audiences.

What you'll do

• Acquire forensic images and volatile data from endpoints and servers.
• Perform disk, memory, and network forensic analysis using [forensic toolset].
• Build timelines that explain initial access, persistence, and data access.
• Maintain chain of custody and evidence handling records.
• Produce written reports suitable for [internal review / legal review].
• Support incident response and [HR or legal] investigations when requested.

Required qualifications

• [X years] of digital forensics experience in an enterprise or consulting setting.
• Working knowledge of NTFS, Windows registry and event logs, and Linux file systems.
• Experience with forensic acquisition and analysis tooling.
• Strong written reporting and attention to evidentiary detail.

Preferred qualifications

• Certified CyberDefender Level 2 (CCDL2) is preferred for this role. Equivalent practical experience or relevant certifications will also be considered.
• Memory forensics experience with tools such as Volatility.
• Experience with mobile or cloud forensic acquisition.

About the role

[Company Name] is seeking a DFIR Analyst who can both run investigations and carry them through to containment and recovery across [environment].

What you'll do

• Investigate escalated alerts and confirmed incidents end to end.
• Acquire and analyze host, memory, and network evidence.
• Drive containment and recovery steps with system and application owners.
• Hunt for related activity across the estate after each investigation.
• Document findings, indicators, and detection gaps for the wider team.

Required qualifications

• [X years] of combined incident response and forensics experience.
• Comfort analyzing endpoint telemetry, logs, and packet or flow data.
• Experience with [EDR platform], [SIEM platform], and [forensic toolset].
• Ability to prioritize under time pressure and communicate status clearly.

Preferred qualifications

• Certified CyberDefender Level 2 (CCDL2) is preferred for this role. Equivalent practical experience or relevant certifications will also be considered.
• Detection engineering experience with Sigma, YARA, or [detection language].
• Automation experience with Python or [SOAR platform].

About the role

[Company Name] is hiring a Threat Hunter to proactively search [environment] for attacker behavior, validate findings with evidence, and convert results into durable detections.

What you'll do

• Develop and test hunt hypotheses based on threat intelligence and [ATT&CK] coverage.
• Query large telemetry sets in [SIEM platform] and [data platform].
• Validate suspicious findings with host, memory, or network evidence.
• Convert successful hunts into detection rules and document coverage gaps.
• Report hunt outcomes, including negative results, with clear reasoning.

Required qualifications

• [X years] of experience in security operations, DFIR, or detection engineering.
• Strong grasp of attacker tradecraft and how it appears in telemetry.
• Query skills in [query language, for example KQL, SPL, or SQL].
• Ability to document methodology so hunts can be repeated.

Preferred qualifications

• Certified CyberDefender Level 2 (CCDL2) is preferred for this role. Equivalent practical experience or relevant certifications will also be considered.
• Experience building detections in [detection platform].
• Familiarity with [cloud provider] and identity attack paths.

About the role

[Company Name] is hiring an experienced security analyst to own escalated investigations, improve detection quality, and raise the standard of analysis across the SOC.

What you'll do

• Investigate escalations from Tier 1 and determine scope and impact.
• Perform deeper host, identity, and network analysis using [toolset].
• Tune detections and reduce recurring false positives in [SIEM platform].
• Mentor Tier 1 analysts and review their investigation notes.
• Contribute to playbooks, runbooks, and knowledge base articles.
• Participate in threat hunts and purple team exercises.

Required qualifications

• [X years] of SOC or security analysis experience.
• Ability to investigate independently across endpoint, identity, and network data.
• Experience improving detection logic and documenting analysis.
• Clear communication with technical and business stakeholders.

Preferred qualifications

• Certified CyberDefender Level 2 (CCDL2) is preferred for this role. Equivalent practical experience or relevant certifications will also be considered.
• Experience with [cloud provider] security telemetry.
• Scripting or automation experience that reduces manual triage.

About the role

[Company Name] is looking for a SOC Team Manager to lead a team of [team size] analysts, own detection and response outcomes, and mature the security operations function.

What you'll do

• Lead, coach, and develop a team of [team size] analysts across [shift model].
• Own SOC metrics such as time to detect, time to respond, and escalation quality.
• Provide technical oversight of significant investigations and hunts.
• Manage staffing, on call rotations, and career development plans.
• Report SOC performance and risk themes to [stakeholder group].
• Plan tooling, process, and automation improvements with [security engineering].

Required qualifications

• [X years] of security operations experience, including [X years] leading analysts.
• Track record of improving detection and response outcomes.
• Experience managing incident escalation and stakeholder communication.
• Strong people management, prioritization, and reporting skills.

Preferred qualifications

• Certified CyberDefender Level 2 (CCDL2) is relevant where this role includes hands on oversight of threat hunting or forensic investigations. It does not replace leadership experience or management qualifications. Equivalent practical experience or relevant certifications will also be considered.
• Experience running a follow the sun or managed service SOC.
• Familiarity with [compliance framework] reporting requirements.