Cybersecurity SOC Analyst

Role overview Investigate security alerts and improve detection across a globally distributed environment, adding coverage during European hours alongside North American operations. The hands-on focus is security operations: analyzing SIEM and data loss prevention events, distinguishing suspicious behavior from expected activity, and helping improve incident response. The role does not center on audits, identity administration, or setting overall security strategy.

Responsibilities - Monitor, triage, and investigate SIEM alerts using logs from firewalls, endpoints, and other sources; support mitigation of confirmed incidents. - Create and refine detection rules that correlate activity across systems, including endpoint detection signals. - Review data loss prevention alerts for potentially inappropriate transfers of company or client information, then follow up with relevant staff and managers. - Use knowledge of the protected systems to assess whether flagged activity is genuinely concerning. - Track emerging threats, malware, and cloud vulnerabilities, and contribute findings to response playbooks and detection improvements. - Identify opportunities to automate alert triage and reduce manual work.

Requirements - Hands-on SOC experience investigating alerts and using a SIEM; this is not an entry-level role. Experience commonly gained over two to four years is the target range, with no stated upper limit. - Practical experience with a SIEM such as Rapid7, Splunk, or Microsoft Sentinel; prior experience with the specific platform in use is not required. - Experience with data loss prevention tools and investigations into potential data exposure. - Ability to interpret security events in the context of the technology and systems involved.