Security Operator (SOC L1)

DAGMA is an IT security expert providing modern solutions to protect IT infrastructure from threats and offers a wide range of cybersecurity services. Within their SOC, they perform Blue Team activities, monitoring IT environment security, analyzing events, and responding to incidents reported by both internal users and external clients.

• High motivation to develop in cybersecurity and work with new technologies.
• Knowledge of the ISO/OSI model and dependencies between network protocols (e.g., ARP, IP, DNS, SNMP, ICMP, HTTP/HTTPS, SMTP).
• Understanding of security services and technologies in at least two areas: AV, XDR, NDR, DLP, firewall, IDS/IPS, WAF, routers, switches.
• Ability to configure and administer Windows or Linux operating systems.
• Basic knowledge of network and system threats.
• Willingness to work in a shift system (24/7/365).
• Minimum one year of documented experience working in SOC or IT.
• Communicative knowledge of English.
• Ability to work in a team and under time pressure.
• Willingness to work onsite at the company headquarters.

Nice to have:

• Experience in creating security procedures and IT documentation.
• Practical experience with SIEM solutions.
• Experience with MITRE ATT&CK frameworks.
• Experience in automating event handling processes.
• Effective collaboration and communication skills, analytical problem-solving, and stress resistance.
• Creative approach to tasks and openness to new challenges.

• Monitor and perform initial analysis of alerts generated by SIEM/XDR/NDR systems, ensuring correct categorization and prioritization.
• Identify potential incidents and unusual activities indicating threats to users, systems, or networks based on available data.
• Analyze suspicious emails and file samples reported by internal users and external clients.
• Prepare response scenarios for newly identified threats and support their implementation.
• Collaborate with L2 and L3 teams in incident handling and escalation, providing thorough analysis and suggesting process improvements.
• Cooperate with teams responsible for security and service continuity, supporting their operational activities.
• Develop incident mitigation strategies and assist in remediation efforts.

Work is onsite at the company headquarters in Katowice. Shift work system (24/7/365) is required.