L1 SOC Analyst (all genders)

Role overview

Monitor customer IT environments as the first point of review in a round-the-clock security operations service. You’ll investigate alerts across security platforms, distinguish likely incidents from false positives, and pass validated cases to more senior analysts. The role is full time and remote for people legally resident in an EU country, with a rotating 24/7 shift schedule.

Responsibilities

- Monitor and triage security events using Splunk Enterprise and Microsoft Defender XDR. - Examine logs, network telemetry, and endpoint alerts to assess potential incidents. - Record confirmed incidents and escalate them to Level 2 or Level 3 analysts. - Take initial response steps during critical situations or off-hours, following customer-approved procedures. - Maintain clear investigation notes in the ticketing system. - Work with senior colleagues to improve detection rules, response playbooks, and alert quality.

Requirements

- One to three years of experience in a SOC or IT security role. - Working knowledge of Splunk, including log searches, dashboards, and basic SPL queries. - Experience investigating alerts in Microsoft Defender XDR or Defender for Endpoint, including host isolation. - Familiarity with TCP/IP, DNS, firewalls, VPNs, and both Windows and Linux environments. - Basic understanding of common attack techniques, MITRE ATT&CK, and malware behavior. - Ability to work rotating day, evening, night, and weekend shifts; strong analysis under pressure; fluent written and spoken English. - Legal residence in an EU country.

Nice to have

- Experience supporting critical infrastructure. - Familiarity with SOAR tools. - Certifications such as CompTIA Security+, CompTIA CySA+, Microsoft SC-200, or Splunk Core Certified Power User.