Cybersecurity SOC Analyst

Role overview Investigate security alerts and help contain verified incidents as part of a global security operations function. The work centers on SIEM monitoring, detection improvements, and reviewing potential exposure of sensitive data, with coverage for European time zones.

Responsibilities - Triage alerts using logs from firewalls, endpoints, and other systems; investigate suspicious activity and support incident mitigation. - Create and refine detection rules that connect events across data sources, including endpoint security signals. - Review data loss prevention alerts involving possible transfers of client or company information to personal email or AI services. - Follow up with staff and managers to understand flagged activity and assess whether it presents a security concern. - Look for ways to automate alert triage and reduce repetitive investigation work. - Track relevant threats, malware, and cloud vulnerabilities, and contribute findings to response playbooks and detection updates.

Requirements - Hands-on experience in security operations investigating alerts; the role is aimed at experience commonly developed over roughly 2–4 years, but that range is not a hard limit. - Practical experience using a SIEM such as Rapid7 InsightIDR, Splunk, or Microsoft Sentinel, with examples of its use in real investigations. - Experience with data loss prevention tools and investigating potential data movement concerns. - Ability to interpret the technology and context behind an alert to distinguish suspicious activity from expected behavior. - Familiarity with endpoint detection and response signals and correlating events from multiple sources.

Nice to have - Experience tuning detections, automating triage, or contributing to incident response playbooks.