Técnico SOC Nivel 1/1.5

This is a fully remote position, open to applicants in Spain.

📋 Description

• Continuous 24x7 monitoring of client systems from the Security Operations Center (SOC)

• Real-time monitoring of security alerts and events in SIEM and associated consoles

• Classification and prioritization of events as true positives, false positives, benign, or informational

• Conducting initial triage through evidence analysis and validation of impact, scope, and urgency

• Opening, documenting, and updating security tickets with timelines, evidence, actions, and conclusions

• Executing standard actions defined in playbooks, such as IP/URL/domain blocking, endpoint isolation, and basic containment

• Structured escalation to Level 2 and specialist IT, networking, and systems teams

• Handover and creation of shift summaries regarding operational continuity, open risks, and next steps

• Participation in the continuous improvement of playbooks, noise reduction, documentation, and service quality

⛳️ Requirements

• Minimum experience: 6–12 months in SOC, monitoring, security support, incident response, or equivalent intensive internships with shifts and tool usage

• Demonstrable knowledge of Windows operating systems (events, processes, services) and foundational Linux

• Knowledge of networking: TCP/IP, DNS, HTTP/HTTPS, proxy, VPN, segmentation concepts, and basic troubleshooting

• Fundamentals of cybersecurity: types of malware, phishing, common intrusion techniques, triage, and containment

• Operational proficiency in at least one SIEM and/or EDR/XDR tool

• Documentation skills: clear and organized writing of tickets, evidence, and technical conclusions

• Availability for 24x7 shifts: weekly rotation (morning/afternoon/night), 5 days/week, including weekends and holidays as scheduled

• Experience with SIEM (e.g., PA XSIAM, Sentinel, Vision One) and/or EDR/XDR (e.g., Defender, Cortex, Trend Micro) is a plus

• Familiarity with MITRE ATT&CK, IoCs, and basic log analysis is valued

• Conceptual knowledge of phishing, spoofing, SPF/DKIM/DMARC is a plus

• Experience following operational procedures, SLAs, and escalation models is valued

• Certifications or specific training (e.g., SC-900, eJPT, or equivalent) are not mandatory

• Availability to work exclusively from Spain

🏝️ Benefits

• Stable job position

• Dynamic and collaborative work environment

• Opportunities for professional development and continuous training

• Online language classes to enhance conversational skills

• Remote work modality

• Day off on your birthday

• Option to participate in flexible compensation plans (restaurant card, transport card, and childcare card)

• Health insurance and Wellhub

• Special discount portal for employees