SOC Analyst

The SOC Analyst owns alert triage, investigates cloud, identity, and endpoint activity, and escalates incidents with actionable context. The role requires 2–3 years of SOC or blue-team experience, hands-on SIEM and EDR work, strong incident documentation, and English communication skills.

About the job

Responsibilities

Alert Triage

Own the alert queue during coverage hours.
Prioritize and disposition alerts accurately and quickly; acknowledge high-severity alerts within 15 minutes and disposition all alerts within SLA.
Distinguish true positives from noise and act accordingly.

Log and Threat Analysis

Analyze cloud, identity, and endpoint log sources to build timelines for alerts requiring deeper investigation.
Use MITRE ATT&CK to understand attack activity in context.

Incident Escalation and Communication

Escalate incidents with severity reasoning, timelines, affected systems, and recommended next steps.
Write clear incident notes and escalations in English.

Runbook Discipline and Improvement

Follow runbooks rigorously.
Identify incorrect steps, missing cases, and outdated assumptions, and propose fixes.

Tuning Feedback Loop

Participate in a weekly feedback cycle with the SOC Engineer.
Report false positives, noise patterns, and detection logic requiring adjustment.

Audit Readiness

Keep monitoring and response evidence current and organized for SOC 2, ISO 27001, and customer incident-response commitments.

Requirements

2–3 years of experience as a SOC analyst or in a blue-team, detection, or response role.
Hands-on alert-triage experience with a SIEM and EDR, including investigation, disposition, and escalation.
Log-analysis experience across cloud, identity, and endpoint sources.
Working knowledge of MITRE ATT&CK and common attack patterns.
Clear written incident notes and escalations in English at B2+ level.
Ability to work a coverage-hours rotation.

Nice to Have

Familiarity with AWS, Azure, or Google Cloud consoles.
Basic Python or Bash scripting.
Phishing and email-threat analysis experience.
BTL1, GCIH, Security+, or CySA+ certification.
Exposure to detection tuning or writing simple detection rules.
Experience at a SaaS or technology startup.

Compensation and Benefits

Competitive salary and equity.
Healthcare, dental, and vision coverage.

Skills

SIEM, Edr, Mitre Att&Ck, Cloud Security, Identity Security, Endpoint Security, AWS, Azure, GCP, Python, Bash, Phishing Analysis, Detection Tuning, SOC 2, ISO 27001