SOC Analyst (20:00–05:00 UTC)

Role overview

Monitor and investigate security events as part of a global, round-the-clock Security Operations Center. This hands-on analyst role covers alert triage, incident response, threat hunting, and clear shift handovers so investigations continue across regions. The scheduled working hours are 20:00–05:00 UTC.

Responsibilities

- Triage alerts from SIEM, endpoint detection and response (EDR), security service edge (SSE), and web application firewall (WAF) systems; assess scope, severity, and impact. - Investigate incidents from initial alert through containment, remediation, escalation, and documentation, coordinating with relevant teams. - Carry out response actions such as isolating endpoints, blocking indicators, disabling compromised accounts, and restricting access. - Hunt across endpoint, network, and log data, using threat intelligence and frameworks such as MITRE ATT&CK to guide investigations. - Improve detection quality by providing feedback and helping tune SIEM rules, endpoint detections, and WAF policies. - Maintain playbooks and technical procedures, support vulnerability management, and provide structured handovers between shifts.

Requirements

- At least three years of hands-on SOC experience triaging alerts and investigating incidents in a production environment. - Working knowledge of SIEM, EDR, SSE, and WAF technologies, plus network, endpoint, and cloud security and Zero Trust principles. - Incident response and threat-hunting experience; familiarity with MITRE ATT&CK is useful. - A relevant degree or equivalent practical experience. - Strong analytical and troubleshooting skills, attention to detail, and responsible handling of sensitive information. - Clear written and verbal English communication, including collaboration across technical teams, non-technical stakeholders, and time zones.

Nice to have

- Experience implementing, configuring, or tuning security platforms, or writing detection content. - Certifications such as Security+, CySA+, GCIA, GCIH, BTL1, or relevant vendor credentials.

Benefits and work setup

- Fully remote work in a global, follow-the-sun team.