Cybersecurity SOC Analyst

This is a fully remote position, open to applicants in Poland, +1 more country.

📋 Description

• Oversee, assess, and investigate security alerts within Rapid7 InsightIDR.

• Correlate logs from firewalls, endpoints, and various devices.

• Assist in the mitigation of confirmed security incidents.

• Develop and refine detection rules across a variety of data sources.

• Utilize SentinelOne endpoint detection and response signals.

• Identify chances to automate triage processes and minimize manual efforts.

• Review Cyberhaven DLP events for any inappropriate movement of company or client data.

• Examine transfers to personal email accounts or AI platforms.

• Follow up with colleagues and managers regarding any flagged activities.

• Differentiate suspicious behavior from usual activity using knowledge of protected technology.

• Monitor emerging threats, malware, and cloud vulnerabilities.

• Contribute insights to incident response playbooks and detection enhancements.

• Provide global support for Kognitiv with coverage during European time zones.

• Report to Ousmane Ndiaye and collaborate on daily security operations.

⛳️ Requirements

• Practical experience as a SOC analyst, investigating alerts and utilizing SIEM platforms.

• Typically possess 2–4 years of experience; this is not an entry-level position.

• Hands-on experience with Rapid7, Splunk, Microsoft Sentinel, or similar SIEM tools.

• Experience in utilizing DLP tools and probing potential data loss or inappropriate data transfers.

• Skills in querying, scripting, or programming relevant to security analysis and detection rules.

• Familiarity with LEQL, KQL, SPL, or Python is advantageous.

• Comprehensive understanding of IT systems, network protocols, and cloud infrastructures.

• Relevant technical degree or equivalent professional experience.

• Practical experience with endpoint detection and response (EDR) tools.

• Methodical approach to active investigations with meticulous attention to log data, network traffic, and indicators of compromise.

• A curious mindset and eagerness to continually learn as threats, vulnerabilities, and attacker tactics evolve.

• Visa sponsorship is not offered.

• Must possess work authorization in the employing country that does not require current or future visa sponsorship.

• Nice to have: Experience with Rapid7, Cyberhaven, or SentinelOne.

• Nice to have: Familiarity with MITRE ATT&CK or CIS Controls.

• Nice to have: Security+, CySA+, relevant Splunk security certification, or Rapid7 InsightIDR Certified Specialist.

• Nice to have: Experience in SIEM engineering or log-platform configuration.

🏝️ Benefits

• Flexible remote work arrangement.

• Regular working hours aligned with the employee’s local time zone.

• Occasional later meetings for cross-regional collaboration.