Lead SOC Analyst

About the role

KalSoft is looking for a Lead SOC Analyst to lead security monitoring, threat detection, investigation, and incident response for AI agents and agentic platforms across the Microsoft ecosystem.

Key responsibilities

• Monitor AI agents and platforms across Microsoft 365, Purview, Defender XDR, Entra ID, Sentinel, and Azure AI Foundry.
• Detect, investigate, and respond to AI‑related threats such as agent takeover, privilege drift, prompt injection, and data poisoning.
• Conduct triage, investigation, escalation and execute containment actions (token revocation, Conditional Access, agent quarantine).
• Develop and fine‑tune detection use cases, analytics rules and monitoring content in Microsoft Sentinel and Defender XDR.
• Maintain agent risk classifications, security certifications, evidence repositories and compliance documentation.
• Track and report detection, response and containment SLAs, KPIs and KRIs.
• Collaborate with client security, identity, governance, Microsoft support and AI agent owners for threat response.
• Participate in a 24/7 operational rota and on‑call support.

Required profile

• Bachelor’s degree in a relevant discipline.
• 5+ years experience in SOC, Managed Security Services, Cyber Defence or Incident Response.
• Hands‑on experience with Microsoft Sentinel, Defender XDR, Purview, Entra ID, Conditional Access and CAE.
• Proven ability to investigate identity‑based attacks, insider threats and cloud security incidents.
• Experience working in a 24/7 security operations environment.

Required skills

• Microsoft Sentinel
• Microsoft Defender XDR
• Microsoft Purview
• Microsoft Entra ID
• Conditional Access & Continuous Access Evaluation (CAE)
• Privileged Identity Management (PIM)
• Kusto Query Language (KQL)
• Role‑Based Access Control (RBAC) & Privileged Access Management (PAM)
• Azure AI Foundry
• Microsoft Copilot Studio
• Microsoft 365 Agents (Agent 365)