Security Operations Center (SOC) Analyst

Brak informacji o wynagrodzeniu

MidOn-site·KrakówFull-time·B2B·Umowa o pracę

#480033·Dodano wczoraj·0

Źródło: justjoin.it

Aplikuj teraz

Tech Stack / Keywords

Palo AltoCrowdstrikeMicrosoft Defender XDRMicrosoft SentinelCybersecurity

Podsumowanie oferty

As a Security Operations Center (SOC) Analyst, you will provide front-line monitoring, investigation, and response across the firm's global environment. You will assess threats using enterprise security platforms and approved AI-assisted capabilities, document findings, execute response procedures, and escalate significant or ambiguous events.

Wymagania

Required qualifications:

Bachelor's degree in Cybersecurity, Computer Science, Information Systems, Information Technology, Engineering, or a related field, or equivalent practical experience.
One to three years of relevant experience in a SOC, incident response, information security, NOC, systems administration, infrastructure operations, cloud operations, or Tier 2+ technical support role.
Experience with security monitoring, log analysis, alert triage, or a Security Information and Event Management (SIEM) platform.
Working knowledge of Microsoft 365, Microsoft Entra ID, Active Directory, Windows, basic Linux administration, and networking fundamentals including DNS, TCP/IP, VPN, and firewalls.
Understanding of common attack techniques, including phishing, credential theft, malware, privilege escalation, lateral movement, and account compromise.
Familiarity with the MITRE ATT&CK framework and basic PowerShell, Python, or comparable scripting.
Strong troubleshooting, analytical, documentation, organizational, and communication skills; able to remain effective during time-sensitive incidents.

Preferred qualifications:

Prior experience as a SOC or NOC analyst, system administrator, infrastructure engineer, Tier 2/3 support professional, or military cyber specialist.
Experience in financial services or another regulated industry.
Hands-on exposure to Microsoft Sentinel, Microsoft Defender XDR, CrowdStrike, Splunk, Proofpoint, SailPoint, Palo Alto Networks, Rapid7, or ServiceNow Security Operations.
Experience using approved large language model or AI-assisted tools for investigation, analysis, documentation, or automation.

Preferred certifications:

Strongly preferred: CompTIA Security+; Microsoft SC-900: Security, Compliance, and Identity Fundamentals.
Preferred: CompTIA CySA+; (ISC)² SSCP; GIAC GSEC or GCIH.

Obowiązki

Security Monitoring & Investigation:

Monitor and triage endpoint, identity, cloud, network, email, and application security alerts.
Correlate logs and evidence across tools to determine scope, severity, and likely impact.
Investigate routine events independently and escalate significant or ambiguous activity with clear findings.
Maintain accurate case notes, timelines, evidence, and incident records.

Incident Response:

Execute approved playbooks and support containment, remediation, recovery, and post-incident reviews.
Investigate phishing, credential misuse, malware, account takeover, privileged-access, and insider-risk scenarios.
Identify affected users, systems, identities, applications, and data sources.

Identity, Email, Endpoint & Cloud Security:

Analyze suspicious authentication, Microsoft Entra ID, Active Directory, multi-factor authentication, and privileged-access activity.
Investigate user-reported phishing and coordinate remediation and follow-up.
Analyze endpoint detections, response alerts, and security events across Microsoft 365, cloud, and SaaS platforms.

Automation & Continuous Improvement:

Use approved AI-assisted tools to help investigate, summarize evidence, and improve analyst efficiency.
Create or modify basic PowerShell, Python, or similar scripts to reduce repetitive work.
Improve runbooks, knowledge articles, detections, and processes by identifying false positives and coverage gaps.

Inne informacje

Shift options are Thursday–Monday or Saturday–Wednesday, 10:30–18:30 CET; the schedule is negotiable.
Work from home is available on weekends; weekdays are office-based.
Candidates from other cities may be considered if willing to move to Kraków (first priority) or Warsaw.

FinDev

Pracodawca

Aplikuj teraz