SOC Analyst (WAAP)

Gcore is a global provider of infrastructure and software solutions for AI, cloud, network, and security, with over 210 edge locations, 50+ cloud regions, and thousands of GPUs. The company collaborates with technology partners like Intel, NVIDIA, Dell, and Equinix, aiming to connect the world to AI anywhere, anytime. Gcore WAAP protects customer web applications and APIs against DDoS, bots, and application-layer attacks at CDN edge scale, delivering a managed-support offering for enterprise customers.

• Understanding of web security fundamentals including WAF, DDoS, bots, and OWASP Top 10.
• Solid basics in HTTP, TCP/IP, and TLS protocols.
• Ability to analyze logs, read dashboards, and spot anomalies in traffic.
• Capable of distinguishing malicious from legitimate traffic and reasoning about false positives.
• Clear written English for composing customer-facing reports.
• Reliable, detail-oriented, and able to remain calm under incident pressure.
• Willingness to work in shift/on-call rotation.

Nice to have:

• Prior SOC L1/L2 or related experience.
• Basic query and scripting skills including SQL-like log queries, regex, and some Python.
• Familiarity with CDN/WAF platforms such as Cloudflare, Akamai, Imperva, F5, Radware.
• Exposure to SIEM/alerting tools and PagerDuty-style on-call systems.
• Security certifications like CompTIA Security+ (optional).

• Monitor WAAP and DDoS activity across customer accounts, including dashboards, alerts, and traffic patterns, to identify issues.
• Triage false positives by reviewing traffic flagged by security policies, confirming or dismissing alerts.
• Prepare weekly threat summaries and post-incident DDoS reports in clear customer-facing English.
• Alert and escalate attacks impacting customers to the engineering team or Support with appropriate context.
• Support customer onboarding by applying standard security configuration based on customer profiles.
• Follow reaction-time SLAs for swift response and clear post-incident reporting.
• Contribute to and maintain runbooks to ensure response consistency and repeatability.

We provide equal opportunity to all applicants without regard to legally protected characteristics.