SOC Analyst Intern

About the Role

R360 is building a dedicated in-house Security Operations Center (SOC) to deliver 24x7 monitoring for its banking-linked platforms serving HDFC Bank, ICICI Bank, and Kotak Mahindra Bank. This internship offers structured, mentored exposure to enterprise EDR/XDR tooling (CrowdStrike Falcon and SentinelOne Singularity) within a live, regulated BFSI environment.

Key Responsibilities (Under Supervision)

• Assist with L1 alert monitoring and triage across CrowdStrike Falcon and SentinelOne Singularity dashboards.
• Learn to map detections against the MITRE ATTCK framework to classify alert severity and intent.
• Support shift handover documentation and SOC ticket logging in Jira.
• Assist senior analysts with evidence collection during incident investigations.
• Learn foundational log correlation across SIEM, WAF, and CloudTrail data sources.
• Participate in SOC playbook walkthroughs and incident-response tabletop exercises.
• Help document standard operating procedures (SOPs) and new detection use cases.
• Progressively take ownership of low-severity alert closure, with mandatory senior-analyst review before closure.

Learning Outcomes

• Hands-on operational experience with two industry-leading EDR/XDR platforms.
• Exposure to real BFSI incident-response workflows and their regulatory context (PCI DSS v4.0.1, RBI Cyber Security Framework).
• Foundational SOC analyst skills that map directly to L1/L2 career progression.

Program Structure

• Month 1-2: Foundations
• SOC fundamentals orientation.
• Guided walkthroughs of CrowdStrike Falcon and SentinelOne Singularity.
• Shadowing L1 analysts on live alerts.
• Month 3-4: Guided Triage
• Hands-on alert triage with mandatory senior review.
• MITRE ATTCK practice drills.
• Introduction to SIEM correlation basics.
• Month 5-6: Supervised Independence
• Independent handling of low-severity alerts (reviewed before closure).
• Capstone project: Build one detection use case or SOC playbook end to end.

Conversion

• Performance evaluated against triage accuracy, escalation judgment, documentation quality, and shift reliability.
• Strong performers are considered for full-time SOC Analyst conversion.

Eligibility

• Graduate with any background.
• Basic understanding of networking fundamentals (TCP/IP, DNS), operating systems (Windows/Linux), and core security concepts.
• Self-driven learners with prior exposure to CTF platforms (TryHackMe, HackTheBox) are strongly preferred.
• Willingness to work in shifts, including some night/weekend rotations, as part of SOC exposure.

Preferred

• A personal CTF/lab track record - TryHackMe or HackTheBox profile link is welcomed with the application.