Cybersecurity SOC Analyst

Role overview Investigate security alerts, improve detection coverage, and monitor potential movement of sensitive company or client data. This hands-on security operations role supports a global environment, adding coverage during European hours and focusing on SIEM investigations, endpoint signals, and data loss prevention.

Responsibilities - Monitor, triage, and investigate alerts using logs from firewalls, endpoints, and other sources; help mitigate confirmed incidents. - Create and tune detection rules that correlate events, including endpoint detection and response signals. - Review data loss prevention alerts for potentially inappropriate transfers, then follow up with employees and managers to understand the activity. - Use knowledge of systems and expected behavior to distinguish suspicious events from legitimate work. - Track threats, malware, and cloud vulnerabilities, and contribute findings to response playbooks and detection improvements. - Identify ways to automate triage and reduce repetitive manual work.

Requirements - Practical SOC experience investigating alerts and using a SIEM, typically gained over two to four years; this is not an entry-level role. - Experience with a SIEM such as Rapid7 InsightIDR, Splunk, or Microsoft Sentinel, and the ability to describe its use in investigations. - Experience with DLP investigations and endpoint detection and response tools. - Querying, scripting, or programming skills for security analysis; relevant examples include LEQL, KQL, SPL, or Python. - Broad understanding of IT systems, network protocols, and cloud architecture, from education or equivalent work experience. - Methodical investigation habits, careful attention to logs and network traffic, and a willingness to keep learning.

Nice to have - Experience with Rapid7, Cyberhaven, or SentinelOne; familiarity with MITRE ATT&CK or CIS Controls. - Security+, CySA+, Splunk security, or Rapid7 InsightIDR certification; SIEM engineering or log-platform configuration experience.

Benefits and work setup - Intended for someone based in Europe, generally working local hours, with occasional later meetings across regions. Visa sponsorship is unavailable.