SOC Analyst

About the Role

You will be at the center of our detection and response operations - investigating real threats across endpoint, network, identity, and cloud environments.

This is a tierless role - you own your cases end-to-end, from first alert through containment and documentation, across multiple client environments simultaneously.

What You'll Do

• Investigate alerts across multiple EDR platforms (CrowdStrike, SentinelOne, Microsoft Defender for Endpoint).
• Conduct end-to-end investigations correlating data across firewall, DC, email security, EDR, and cloud audit logs.
• Investigate threats across cloud environments (AWS, Azure, GCP) - including identity abuse, misconfigurations, and cloud-native attack techniques.
• Monitor and triage alerts; determine scope, severity, and escalation path.
• Classify, document, and track cases through their full lifecycle using ticketing and case management systems.
• Contribute to detection rule tuning across SIEM and EDR platforms to reduce false positives and close coverage gaps.
• Maintain shift handover documentation and contribute to IR runbooks and playbooks.
• Share knowledge through peer walkthroughs, ticket reviews, and internal sessions that raise the team's level.

What You'll Bring

• Solid grasp of network protocols, attack patterns, and core security controls (firewall, IDS/IPS, proxy, WAF).
• Hands-on familiarity with at least one EDR platform and SIEM environment.
• Understanding of Windows/Linux internals relevant to attacker techniques (persistence, lateral movement, credential access).
• Foundational knowledge of cloud environments - IAM, logging, and common attack surfaces.
• Fluent written and spoken English.
• Availability for 9-hour rotating shifts, including nights and weekends (Sun–Sat).
• A drive to keep learning - you are always in a cycle of improving your skills, deepening your knowledge, and raising your own bar.
• Self-motivated and independent - you take ownership, dig deep into every investigation, and push yourself to find the full answer.