Security Operations Center (SOC) Analyst
A company Cybersecurity organization is seeking a Security Operations Center (SOC) Analyst to provide front-line monitoring, investigation, and response across the firm's global environment. The role is intended for a technical professional with foundational cybersecurity knowledge and practical experience in security operations, IT operations, infrastructure support, networking, systems administration, or a related discipline.
The analyst will use enterprise security platforms and approved AI-assisted capabilities to assess threats, document findings, execute established response procedures, and escalate significant or ambiguous events. The position provides a development path into senior SOC analysis, incident response, threat hunting, detection engineering, and cybersecurity engineering.
Measures of Success
- Independently investigates routine alerts and follows escalation standards.
- Produces complete, concise, and defensible investigation records.
- Demonstrates proficiency with the firm's primary security platforms and playbooks.
- Contributes measurable improvements to runbooks, detections, automation, or analyst workflows.
- Builds trusted working relationships with Cybersecurity, Infrastructure, and business stakeholders.
Locations
- Poland
What you will do
Security Monitoring & Investigation
- Monitor and triage endpoint, identity, cloud, network, email, and application security alerts.
- Correlate logs and evidence across multiple tools to determine scope, severity, and likely impact.
- Independently investigate routine events and escalate significant or ambiguous activity with clear findings.
- Maintain accurate case notes, timelines, evidence, and incident records.
Incident Response
- Execute approved playbooks and support containment, remediation, recovery, and post-incident review activities.
- Investigate phishing, credential misuse, malware, account takeover, privileged-access, and insider-risk scenarios.
- Identify affected users, systems, identities, applications, and data sources.
Identity, Email, Endpoint & Cloud Security
- Analyze suspicious authentication, Microsoft Entra ID, Active Directory, multi-factor authentication, and privileged-access activity.
- Investigate user-reported phishing and coordinate remediation and follow-up.
- Analyze endpoint detections and response alerts and security events across Microsoft 365, cloud, and SaaS platforms.
Automation & Continuous Improvement
- Use approved AI-assisted tools to help investigate, summarize evidence, and improve analyst efficiency.
- Create or modify basic PowerShell, Python, or similar scripts to reduce repetitive work.
- Improve runbooks, knowledge articles, detections, and processes by identifying false positives and coverage gaps.
Required
- Bachelor's degree in Cybersecurity, Computer Science, Information Systems, Information Technology, Engineering, or a related field, or equivalent practical experience.
- One to three years of relevant experience in a SOC, incident response, information security, NOC, systems administration, infrastructure operations, cloud operations, or Tier 2+ technical support role.
- Experience with security monitoring, log analysis, alert triage, or a Security Information and Event Management (SIEM) platform.
- Working knowledge of Microsoft 365, Microsoft Entra ID, Active Directory, Windows, basic Linux administration, and networking fundamentals including DNS, TCP/IP, VPN, and firewalls.
- Understanding of common attack techniques, including phishing, credential theft, malware, privilege escalation, lateral movement, and account compromise.
- Familiarity with the MITRE ATT&CK framework and basic PowerShell, Python, or comparable scripting.
- Strong troubleshooting, analytical, documentation, organizational, and communication skills; able to remain effective during time-sensitive incidents.
Nice to have
- Prior experience as a SOC or NOC analyst, system administrator, infrastructure engineer, Tier 2/3 support professional, or military cyber specialist.
- Experience in financial services or another regulated industry.
- Hands-on exposure to Microsoft Sentinel, Microsoft Defender XDR, CrowdStrike, Splunk, Proofpoint, SailPoint, Palo Alto Networks, Rapid7, or ServiceNow Security Operations.
- Experience using approved large language model or AI-assisted tools for investigation, analysis, documentation, or automation.
Preferred Certifications
Strongly Preferred: CompTIA Security+; Microsoft SC-900: Security, Compliance, and Identity Fundamentals
Preferred: CompTIA CySA+; (ISC)² SSCP; GIAC GSEC or GCIH
Benefits
- Flexible work setup: remote or a hybrid model.
- Health insurance coverage
- 50% coverage of health insurance for spouses and children
- 24 days of paid vacation.
- 10 days of paid sick leave.
- 50% reimbursement for professional training, education, conferences.
- Work alongside a highly professional team.
- Engaging teambuilding events and activities.
In case of relocation to Poland, we offer:
- Flight tickets, accommodation rent for 1st month for our relocated employee and his/her official family.
- Visa sponsorship, including support with the visa application process, entry permits, and residence permits.