SOC Analyst (12:00–21:00 UTC)

Role overview

Monitor and investigate security activity as part of a global, around-the-clock Security Operations Center. The work covers alert triage, incident response, threat hunting, and improving detection quality, with careful handovers between regional shifts. The scheduled working hours are 12:00–21:00 UTC, and the role is fully remote.

Responsibilities

- Review and investigate alerts across SIEM, endpoint detection and response, security edge, and web application firewall platforms. - Assess incident scope, severity, and impact; distinguish false alarms from real threats and escalate confirmed incidents. - Carry out authorized response actions, such as isolating endpoints, blocking indicators, disabling accounts, and restricting access. - Track incidents through analysis, containment, remediation, and documentation, coordinating with relevant technical teams. - Hunt for suspicious activity in endpoint, network, and log data, using frameworks such as MITRE ATT&CK to organize findings. - Improve detection rules and response procedures, use threat intelligence in investigations, and make clear shift handovers.

Requirements

- At least three years of hands-on SOC experience investigating alerts and incidents in a production environment. - Working knowledge of SIEM, EDR, SSE, and WAF tools and how to use them in investigations and response. - Experience with incident response and threat hunting; familiarity with MITRE ATT&CK is useful. - Understanding of network, endpoint, and cloud security, as well as Zero Trust principles. - Strong analytical and troubleshooting skills, careful handling of sensitive information, and clear written and spoken English. - A relevant degree or equivalent practical experience.

Nice to have

- Experience configuring or tuning security platforms and developing detection content. - Certifications such as Security+, CySA+, GCIA, GCIH, BTL1, or relevant vendor credentials.

Benefits and work setup

Work remotely with an international team in a follow-the-sun operations model. The role requires reliable coordination across time zones and structured handovers.