Review and respond to security alerts and tickets generated from the client’s monitoring and security platforms
Investigate and triage alerts related to
Endpoint security events
Email threats and phishing activity
Suspicious authentication attempts
Firewall and network security events
Perform incident response activities including
Documentation
Initial remediation actions
Escalation and coordination
Post-mortem reporting
Validate email and phishing-related incidents using
Mimecast
KnowBe4 / PhishER / PhishRip workflows
Monitor and respond to endpoint alerts within
Sophos EDR/XDR
Sophos Intercept X Advanced
Investigate identity and authentication alerts from Microsoft environments, including
Sign-in risk events
Suspicious token or authorization activity
IP/location anomalies
Support security investigations involving
Sophos firewall alerts
Fortinet networking environments
MFA and authentication platforms (including YubiKey environments)
Coordinate with client help desk and infrastructure teams for remediation support and escalation handling
Maintain accurate documentation of incidents, actions taken, and recommendations