Security Operations Analyst (L1-L2)

Role overview Triage and investigate security alerts as part of a security operations team. You’ll gather context from security and business data, determine whether activity appears malicious or benign, document your findings, and escalate incidents that may pose significant risk. The role is suited to someone with at least a year of hands-on alert triage experience.

Responsibilities - Review prioritized alerts and assess whether they indicate a genuine security concern. - Enrich cases by correlating endpoint, identity, network, service, asset, and user information. - Investigate initial scope and severity, record evidence and reasoning, and maintain a clear incident timeline. - Close false positives and take approved low-risk actions. - Escalate suspected incidents, privileged account concerns, and cases with potentially broad or production impact. - Write useful handover notes and contribute to better case practices and runbooks.

Requirements - At least one year of commercial alert triage experience using a SIEM, with working familiarity with EDR or XDR and case-management processes. - Ability to write basic SIEM searches, filter events, and correlate activity across data sources; familiarity with query languages such as KQL or EQL is relevant. - Ability to interpret common endpoint, identity, authentication, network, DNS, HTTP, and service or cloud audit data. - Working knowledge of Windows, Linux, TCP/IP, access controls, and common attack patterns including phishing, credential abuse, and malware execution. - Ability to distinguish malicious activity from benign events, estimate preliminary severity, identify affected users or assets, and flag uncertainty. - Familiarity with indicators of compromise, reputation checks, threat intelligence, and the MITRE ATT&CK framework. - Clear documentation of evidence, actions, conclusions, and escalations.

Nice to have - Basic Python or PowerShell scripting for investigation or enrichment. - Exposure to cloud, email security, SaaS audit logs, or phishing investigations. - Practical cybersecurity lab experience, an entry-level security certification, or macOS familiarity.

Benefits and work setup - Remote work, 20 paid vacation days, 10 paid sick days, and public holidays. - Budgets for medical care, professional education, language learning, and wellness expenses.