Security Operations Center (SOC) Analyst

Cybersecurity organization is seeking a Security Operations Center (SOC) Analyst to provide front-line monitoring, investigation, and response across the firm's global environment. The role is intended for a technical professional with foundational cybersecurity knowledge and practical experience in security operations, IT operations, infrastructure support, networking, systems administration, or a related discipline.

The analyst will use enterprise security platforms and approved AI-assisted capabilities to assess threats, document findings, execute established response procedures, and escalate significant or ambiguous events. The position provides a development path into senior SOC analysis, incident response, threat hunting, detection engineering, and cybersecurity engineering.

Measures of Success

• Independently investigates routine alerts and follows escalation standards.

• Produces complete, concise, and defensible investigation records.

• Demonstrates proficiency with the firm's primary security platforms and playbooks.

• Contributes measurable improvements to runbooks, detections, automation, or analyst workflows.

• Builds trusted working relationships with Cybersecurity, Infrastructure, and business stakeholders.

Locations

Poland

What you will do

Security Monitoring & Investigation

• Monitor and triage endpoint, identity, cloud, network, email, and application security alerts.

• Correlate logs and evidence across multiple tools to determine scope, severity, and likely impact.

• Independently investigate routine events and escalate significant or ambiguous activity with clear findings.

• Maintain accurate case notes, timelines, evidence, and incident records.

Incident Response

• Execute approved playbooks and support containment, remediation, recovery, and post-incident review activities.

• Investigate phishing, credential misuse, malware, account takeover, privileged-access, and insider-risk scenarios.

• Identify affected users, systems, identities, applications, and data sources.

Identity, Email, Endpoint & Cloud Security

• Analyze suspicious authentication, Microsoft Entra ID, Active Directory, multi-factor authentication, and privileged-access activity.

• Investigate user-reported phishing and coordinate remediation and follow-up.

• Analyze endpoint detections and response alerts and security events across Microsoft 365, cloud, and SaaS platforms.

Automation & Continuous Improvement

• Use approved AI-assisted tools to help investigate, summarize evidence, and improve analyst efficiency.

• Create or modify basic PowerShell, Python, or similar scripts to reduce repetitive work.

• Improve runbooks, knowledge articles, detections, and processes by identifying false positives and coverage gaps.

Required

• Bachelor's degree in Cybersecurity, Computer Science, Information Systems, Information Technology, Engineering, or a related field, or equivalent practical experience.

• One to three years of relevant experience in a SOC, incident response, information security, NOC, systems administration, infrastructure operations, cloud operations, or Tier 2+ technical support role.

• Experience with security monitoring, log analysis, alert triage, or a Security Information and Event Management (SIEM) platform.

• Working knowledge of Microsoft 365, Microsoft Entra ID, Active Directory, Windows, basic Linux administration, and networking fundamentals including DNS, TCP/IP, VPN, and firewalls.

• Understanding of common attack techniques, including phishing, credential theft, malware, privilege escalation, lateral movement, and account compromise.

• Familiarity with the MITRE ATT&CK framework and basic PowerShell, Python, or comparable scripting.

• Strong troubleshooting, analytical, documentation, organizational, and communication skills; able to remain effective during time-sensitive incidents.

Nice to have

• Prior experience as a SOC or NOC analyst, system administrator, infrastructure engineer, Tier 2/3 support professional, or military cyber specialist.

• Experience in financial services or another regulated industry.

• Hands-on exposure to Microsoft Sentinel, Microsoft Defender XDR, CrowdStrike, Splunk, Proofpoint, SailPoint, Palo Alto Networks, Rapid7, or ServiceNow Security Operations.

• Experience using approved large language model or AI-assisted tools for investigation, analysis, documentation, or automation.

Preferred Certifications

• Strongly Preferred: CompTIA Security+; Microsoft SC-900: Security, Compliance, and Identity Fundamentals

• Preferred: CompTIA CySA+; (ISC)² SSCP; GIAC GSEC or GCIH

Benefits

• Flexible work setup: remote or a hybrid model.

• Health insurance coverage 50% coverage of health insurance for spouses and children.

• 24 days of paid vacation.

• 10 days of paid sick leave.

• 50% reimbursement for professional training, education, conferences.

• Work alongside a highly professional team.

• Engaging teambuilding events and activities.

• In case of relocation to Poland, we offer: Flight tickets, accommodation rent for 1st month for our relocated employee and his/her official family. Visa sponsorship, including support with the visa application process, entry permits, and residence permits.