SOC AnalystEnglish summary from Japanese

Must-haves

• Real-time monitoring and triage of alerts from SIEM/EDR
• In-depth investigation of logs, terminals, and communications
• Incident containment (account disabling, terminal isolation, etc.)
• Coordination and escalation with related departments
• Incident recording and reporting
• Threat intelligence gathering and analysis
• Vulnerability information gathering and analysis

Nice-to-haves

• Planning and strategy development for the SOC
• SOC infrastructure design, construction, and operation
• Threat hunting
• Verification and implementation of triage automation, detection enhancement, and analysis support

Tech stack