Senior Security Analyst (L2/L3)

We're looking for a Security Analyst to join the Security Team. This role sits within the analytics direction of our cross-functional Security team, focused on detection, monitoring, and incident response.

In this role, you'll work closely with infrastructure teams (Admins, NOC, OPS, Compliance), translating security signals into actionable findings and coordinating response across operating systems, infrastructure, and cloud environments. 

• You'll be responsible for security event monitoring, incident response, and continuous improvement of detection and IR processes.

• We work in Agile (2-week sprints, grooming, planning, retrospectives) and use Google Meet, Slack, TargetProcess, Wiki and Confluence for teamwork.

• Working hours: business hours, with paid overtime in case of incidents.

• You'll work with a modern stack and grow within the company — including cloud and hybrid infrastructure, and AI applied to real security work.

Tech Stack: Splunk, CheckPoint, Rapid, AWS, OpenStack, Gitlab, Kubernates, IaC, Python, Linux, Windows, MacOS.

Tasks

• Event correlation rules development.

• Incident response playbooks development and automation.

• Security events analysis and monitoring.

• Participating in and/or leading incident response processes.

• Search, analysis, and coordination of vulnerability remediation.

• Detection rules operational checks via attack emulation.

• Security tools research and development.

• Conducting periodic incident response exercises.

• Participating in Compliance and Security Audits.

• Defining requirements for the secure configuration of operating systems, networks, and services in terms of information security incident processing.

Requirements

• At least 3 years of specialized experience as a Security Analyst, including L2 incident response responsibilities.

• Automation skills (Python).

• Experience investigating incidents in distributed environments, including those affecting remote employees.

• Experience collecting and processing indicators of compromise from various systems.

• Experience writing correlation rules.

• Experience testing correlation searches via attack emulation.

• Knowledge of security mechanisms of modern operating systems.

• Understanding of network, infrastructure, web application, and cloud attack techniques.

• Hands-on experience operating Splunk (or an any SIEM with willingness to ramp on Splunk quickly).

• Experience analyzing network traffic.

• Experience with MITRE ATT&CK.

• Soft skills to communicate effectively with other IT and Business teams.

• Russian C1 and English B1/B2 for internal and cross-team work.

Nice to have

• Experience in the Fintech industry.

• Hands-on experience with EDR (SentinelOne preferred).

• Experience in vulnerability analysis.

• Experience using AI tooling for security tasks.

• Experience composing regular expressions.

• Knowledge of SQL and experience with relational databases.

• Experience building or operating opensource analytical systems as supplementary data sources for investigations (ELK, Loki, Greenplum, ClickHouse, etc.).

• Experience going through compliance audits (PCI DSS, DORA, etc.).

We offer

• Full-time remote work model (service provider contract).

• Competitive compensation (paid in EUR).

• Flexible working hours.

• All necessary tools for comfortable and efficient work.

• Corporate training.

• Corporate AI subscriptions (Claude, Gemini, GPT, etc.). 

• Access to a rewards marketplace offering products and language courses, redeemable using the company’s internal currency.

• A friendly, supportive, and positive working environment where your data-driven decisions directly impact the product.