Family Bank (formely Family Finance Building Society) was registered as a Building Society in October 1984 in Kenya, under the Building Societies Act and commenced operations in the early 1985. Family Bank converted into a fully fledged bank in May 2007 and the main driver for our conversion was the need to offer a wider range of products and services to our...

Job Purpose:

The SOC Analyst is responsible for continuous 24x7 monitoring, detection, analysis, and response to cybersecurity events across the Bank’s technology environment. The role safeguards the confidentiality, integrity, and availability of systems, data, and digital services through intelligence-led monitoring, incident investigation, proactive threat hunting, and disciplined incident response, ensuring timely threat containment, regulatory compliance, and the uninterrupted delivery of customer-facing services.

Key Responsibilities:

• Monitor security alerts across security tools such as SIEM, EDR/XDR, NDR, IDS/IPS, WAF, DLP, email and cloud security platforms.
• Triage, analyse, and classify security events based on severity and impact.
• Investigate suspicious activity and escalate incidents in line with the Incident Response Plan.
• Tune detection rules, correlation logic, and thresholds to reduce false positives.
• Update detection logic with relevant threat-intelligence indicators.
• Identify automation opportunities and support SOAR playbook improvements.
• Support detection, containment, eradication, and recovery activities for security incidents.
• Preserve digital evidence in line with forensic and chain-of-custody standards.
• Tune detection rules, correlation logic, and thresholds to reduce false positives.
• Identify automation opportunities and support SOAR playbook improvements.
• Review threat-intelligence feeds relevant to the banking sector.
• Assess applicability of global threat alerts to the Bank's environment.
• Contribute to SOC KPIs and KRIs aligned to operational performance metrics.

Qualifications & Experience:

• Bachelor's degree in IT, Computer Science, Cybersecurity, or related field.
• Professional Certifications (At least one preferred)
  • Certified Ethical Hacker (CEH)
  • Computer Hacking Forensic Investigator (CHFI)
  • CompTIA Security+
  • CISA/CISM
  • ISO 27001 Foundation
  • Any other relevant Cybersecurity certification
• 1–3 years in SOC or cybersecurity operations (covers L1–L2 levels).
• Experience with SIEM, EDR/XDR, network security, firewall and endpoint logs.
• Experience in banking or regulated environments is an advantage.

• Monitor security alerts across security tools such as SIEM, EDR/XDR, NDR, IDS/IPS, WAF, DLP, email and cloud security platforms.
• Triage, analyse, and classify security events based on severity and impact.
• Investigate suspicious activity and escalate incidents in line with the Incident Response Plan.
• Tune detection rules, correlation logic, and thresholds to reduce false positives.
• Update detection logic with relevant threat-intelligence indicators.
• Identify automation opportunities and support SOAR playbook improvements.
• Support detection, containment, eradication, and recovery activities for security incidents.
• Preserve digital evidence in line with forensic and chain-of-custody standards.
• Tune detection rules, correlation logic, and thresholds to reduce false positives.
• Identify automation opportunities and support SOAR playbook improvements.
• Review threat-intelligence feeds relevant to the banking sector.
• Assess applicability of global threat alerts to the Bank's environment.
• Contribute to SOC KPIs and KRIs aligned to operational performance metrics.

• SIEM
• EDR/XDR
• NDR
• IDS/IPS
• WAF
• DLP
• Email security
• Cloud security
• Incident Response
• Threat hunting
• Forensics
• Chain-of-custody
• Threat intelligence
• SOAR
• Network security
• Firewall logs
• Endpoint logs

• Bachelor's degree in IT, Computer Science, Cybersecurity, or related field.
• Certified Ethical Hacker (CEH)
• Computer Hacking Forensic Investigator (CHFI)
• CompTIA Security+
• CISA/CISM
• ISO 27001 Foundation
• Any other relevant Cybersecurity certification