What the roles are
Tiered work, and a door in from each IT background
Defensive security is tiered. SOC analysts watch and triage; security engineers build and tune the controls; cloud security engineers do the same inside AWS, Azure or GCP. Transition guides and the Indian postings both point IT professionals at the first tier and at hybrid IT-security roles, and away from penetration testing, architecture and GRC until they hold a security job.
SOC analyst L1 and L1.5
Monitor SIEM alerts, triage, collect evidence, document, ticket and escalate to an SLA on 24x7 shifts. At L1.5: investigate phishing, malware and account compromise, do root cause from Windows, Linux, AD, firewall and EDR logs, tune rules. The most common first security job.
SOC analyst L2 and security engineer
Escalation point for high and critical incidents; detection rule building in the SIEM; threat hunting with MITRE ATT&CK; SOP and playbook ownership. Engineers deploy and run the SIEM, EDR, firewalls and IAM themselves.
Cloud security engineer
CSPM monitoring (Wiz, Prisma Cloud), IAM policy, S3 and security-group fixes, KMS encryption, network segmentation, remediation tracking and posture reports. Cloud skills carry the highest pay premiums in the analyst studies.
What transfers from IT work
| What you do now | What it becomes |
|---|---|
| Password resets, MFA setup | Identity and access management; account-compromise investigation |
| Antivirus, patching | Endpoint security (EDR consoles), vulnerability management |
| Firewall rules, VPN, DNS, TCP/IP | Network security; the "common ports and protocols" every SOC posting lists |
| Log review, tickets to an SLA | SIEM monitoring, incident documentation, escalation |
| Windows, Linux, AD administration | The log sources an L1.5 analyst does root cause from |
| Spam filtering, user training | Email security, phishing investigation |
Mapping from the IT Support Group guide and the Zensar and Deepwatch requirements. The guides' summary: support reacts to breakage, security anticipates it, and interviews test that shift.
"Perform root cause analysis using logs from Windows, Linux, Active Directory, firewalls, IDS/IPS, EDR/XDR, proxy and email security, and Azure, AWS or GCP… Map activity to MITRE ATT&CK."
Zensar Technologies, SOC Analyst L1.5, Hyderabad, posted 20 Oct 2026Who it is for
Built for people with real IT exposure and the patience for a queue
The SOC door is open to people with no security title but real IT work behind them, provided they bring a SIEM skill and a documented lab. L1.5, L2 and engineering seats ask for three to eight years. Entry-level is 3.7% of information security analyst postings worldwide, so the lab and the SIEM are what separate applicants.
✓A fit if you
- Work in IT support or helpdesk and already handle tickets to an SLA, reset accounts, manage antivirus and read logs
- Work in a NOC or IT operations with shifts, escalation and incident documentation; the SOC runs the same way
- Are a network engineer who knows TCP/IP, DNS, VPN, firewalls, IDS/IPS and proxies
- Are a sysadmin who administers Windows, Linux and Active Directory, the log sources every L1.5 posting names
- Can write a thorough, accurate report and explain a finding to someone non-technical
- Can work rotational or 24x7 shifts and on-call, which L1 and L1.5 roles in India assume
…Not yet if you
- Are counting on a certification without a lab: postings pair Security+, CEH or Splunk certs with SIEM query ability, and 63% of employers say candidates lack hands-on skills
- Want to start in penetration testing, architecture or GRC: the guides and the posting bars put those after a first security role
- Have no exposure to Windows, Linux or networking: SOC postings assume all three
- Cannot work shifts
Seniority in 5,066 analyst postings: entry 3.7%, mid 77%, senior 13%, staff 7%. Onsite 55%, hybrid 20%, remote 9%. InterviewStack, Jun 2026
Experience bars in current India postings
| Employer, role | Location | Years required | Also asks for |
|---|---|---|---|
| Prudent Globaltech, SOC Analyst L1 | Hyderabad | 0–2 | Splunk Power User skills and certification; SPL searches, dashboards, alerts; incident documentation; BMC Remedy; rotational or night shifts |
| Deepwatch, Security Analyst I | Bengaluru | 0+ | SIEM query writing (ideally Splunk); EDR, email security, cloud identity basics; ports and protocols; OSINT, TTPs, IOCs; strong written reports; preferred CEH, CySA, GSEC, Security+ |
| Noventiq, Cloud Security Engineer | Mumbai | 2–3 | AWS; CSPM (Wiz or Prisma Cloud); IAM, S3, security groups, KMS, segmentation; remediation tracking and posture reports |
| Zensar, SOC Analyst L1.5 | Hyderabad, 24x7 | 3+ | Logpoint, Sentinel, Splunk, QRadar or ArcSight; Defender, CrowdStrike, Palo Alto, Fortinet; Windows and Linux admin, TCP/IP, DNS, VPN; MITRE ATT&CK, Kill Chain, NIST IR; preferred SC-200, CEH, Security+ |
| BluSapphire Cyber, L2 SOC Analyst | Hyderabad, on-call | 5–8 | Escalation point for critical incidents; detection rules in Splunk, QRadar, Sentinel; forensics, malware assessment, threat hunting; playbook ownership; plus CISSP, CEH, GCIH, OSCP |
Postings read between 30 Oct and 5 Nov 2026 via company sites and job boards. The Zensar posting closed on 23 Oct 2026 and is quoted for its requirements, which recur across similar roles.
Skills to learn
A bundle, not one skill
No single security skill appears in more than a third of postings. The job is SIEM and incident response layered on the operating systems and networking you have, with cloud and scripting as the skills that lift pay the most. The chart is from a US-weighted sample in which India is the second-largest country; the Indian postings above ask for the same list.
Share of 5,066 information security analyst postings naming each skill
June 2026, 7.9% of the sample in India. InterviewStack
Which skills move pay, in the same study
US median base for the role is $95,700. The skills below carry the largest premiums; cloud and scripting lead, SIEM and monitoring add little on their own. Directional for India.
Across 44,055 security postings the top asks are communication 33%, incident response 30%, SIEM 14%, Python 13%, risk management 13%. CISSP appears in 5%, almost always as preferred. Huntr, Jul 2026
Operating systems and networking
Deepen what you have
- Windows and Linux administration, Active Directory, file-path structures across Windows, macOS and Linux
- TCP/IP, DNS, DHCP, VPN, HTTP/HTTPS, SMTP; the common ports and protocols every SOC posting lists
- What firewall, proxy, VPN, DNS and IDS/IPS logs actually show
- Wireshark and Nmap as the daily tools
SIEM, detection and response
The core of the job
- One SIEM well: Splunk (SPL, dashboards, alerts), Microsoft Sentinel (SC-200), QRadar, ArcSight or Logpoint
- Alert triage, evidence collection, incident documentation, ticketing (BMC Remedy, ServiceNow), escalation to SLA
- NIST incident response lifecycle; containment, eradication, recovery; phishing, malware, ransomware and account-compromise investigations
- Rule tuning, false-positive reduction, log-ingestion checks (L1.5 up)
Threat frameworks and tooling
Speak the SOC's language
- MITRE ATT&CK, Cyber Kill Chain, TTPs, IOCs and IOAs, OSINT; threat hunting at L1.5 and above
- EDR (CrowdStrike, Defender, SentinelOne), firewalls (Palo Alto, Fortinet, Check Point, Cisco), SOAR, email security, DLP, Nessus
- Frameworks for hybrid IT-security roles: NIST CSF, CIS Controls, ISO 27001
- Certifications as the postings treat them: Security+, CEH, CySA+, SC-200 and Splunk certs preferred at L1 and L1.5; CISSP, GCIH, OSCP at L2. Preferred, not sufficient
Cloud security and scripting
The two skills that move pay
- AWS IAM policies, S3 permissions, security groups, KMS, network segmentation; Azure and GCP equivalents; cloud identity platforms
- CSPM tools (Wiz, Prisma Cloud) and the posture report they produce
- Python and PowerShell for log parsing, IOC enrichment and response playbooks; automation plus Python co-occur with a lift of 3.5
- Reading and modifying scripts first; writing them from scratch second
Skill groups compiled from the Prudent, Deepwatch, Zensar, BluSapphire and Noventiq postings and the InterviewStack and Huntr posting analyses.
Projects to build
A lab, the write-ups from it, and one script
The projects that match these postings are a documented home lab with a SIEM, investigations written up in the incident-response lifecycle, and a small automation tool. Employers screen for evidence of hands-on work because most say candidates lack it. Pick by your target seat.
Everyone · the baseline
A home SOC lab with a SIEM
A pfSense firewall, a Windows and a Linux host, an attack machine, and Wazuh, Security Onion or a Splunk free instance collecting the logs.
Must include: a labelled network diagram with IPs, OS and roles; screenshots of alerts firing; a "what broke and how I fixed it" section; no real IPs or credentials in the repository.
SOC analyst L1 to L2
Detection and incident write-ups
Five to ten alerts you generated in the lab (failed logins then success, suspicious PowerShell, a phishing attachment, a port scan), plus one full incident from a CTF or archived challenge.
Must include: for each alert, the SIEM query, evidence, true or false positive, severity, escalation decision and the MITRE ATT&CK technique; the incident structured by NIST SP 800-61 with timestamps, IOCs and reasoning at each step.
Security engineer and cloud security
An automation script and a cloud posture review
A Python or PowerShell log analyser that flags IPs over a failed-login threshold and emits a blocklist; and a misconfigured AWS free-tier account scanned with Prowler or ScoutSuite.
Must include: a README with usage and sample output, error handling, design choices explained; findings ranked by severity with the IAM, S3, security-group and KMS fixes applied and re-scanned, written up as a short posture report.
The three artefacts to walk into an interview with
- A public repository or blog with the lab diagram, screenshots and write-ups, with nothing real committed: no IPs, credentials or keys.
- The triage and incident write-ups, written the way a SOC ticket and a postmortem are written, so an interviewer can read your method before you speak.
- A one-page translation of your IT work into security terms, the guides' first step, used in the resume and the screen: tickets to SLA, change control, access reviews, log review.
Timeline the guides give a working IT professional: skills audit in weeks one and two, frameworks and tools in months one to three, Security+ in months two to four, the lab in months two to five, applications from month four. About six months part-time.
What does not count
- Course certificates and CTF badges with no write-ups beside them
- A lab with setup steps but no diagram and no failure story
- Journal-style notes that say an exploit worked, with no evidence, severity or fix
- Published solutions to live challenges, or anything with real customer data
- Stacking a third certification before applying for a first role
Match the project to the seat: lab plus triage write-ups for SOC analyst, the script for security engineer, the posture review for cloud security.
The interview loop
Triage scenarios, not theory
SOC and security interviews are built around alerts: how you investigate one, which logs you pull, when you escalate. A knowledge section covers log sources and the incident-response lifecycle, a judgment section covers escalation and pressure, and some loops add a hands-on SIEM query. Indian postings add shift and SLA questions because the roles are 24x7.
Screen
Background, why security, shift availability, which SIEM you have used and what you built in your lab.
Triage scenarios
"An alert fires for a suspicious PowerShell execution on a workstation. Walk me through what you do." "You see 200 failed logins on one account followed by a success. What now?" "How do you tell a false positive from a true positive?" "Tell me about a time you were wrong about an alert."
Phishing and log analysis
"A user reports a phishing email. Take me through your analysis." "What log sources would you want for a compromised endpoint?" A hands-on SIEM exercise: filter the logs and find the anomaly.
Incident response and networking knowledge
"Explain the incident response lifecycle." "What is lateral movement and how would you spot it?" Ports and protocols; what DNS, VPN and proxy logs show.
Judgment
"When do you escalate?" "An executive's laptop triggers a detection during a board meeting. What do you do?" Handling pressure and SLAs on a shift.
For engineer and cloud roles
A detection rule or IAM policy to review, a CSPM finding to explain and fix, a log parser to script.
What strong answers do
- Follow a visible method: what the alert says, what evidence to gather, which log sources, true or false positive, severity, contain or escalate, document
- Name the technique (MITRE ATT&CK) and the lifecycle stage (NIST) without being asked
- Bring a lab example for every scenario: "I built this alert in Wazuh and here is what the false positives looked like"
- Translate IT experience directly: ticket discipline, SLA handling, change control, user communication
How to prepare
- Practise the five scenarios above out loud with your own lab evidence
- Know one SIEM's query language well enough to filter and pivot live
- Be able to explain the IR lifecycle and the Kill Chain in two minutes each
- Prepare questions about shift model, alert volume and the path from L1 to L2
Scenarios from InfoSec Job Board; round structure from the Zensar, Deepwatch and BluSapphire postings.