Security Analyst

Role overview

Monitoring and incident response

• Monitor and investigate security alerts; make incident decisions and serve as senior escalation support for analysts.
• Investigate EDR/NDR threats, including malware, credential theft, lateral movement, persistence, and ransomware.
• Own incidents through identification, containment, eradication, recovery, and post-incident review; coordinate remediation across technical teams.
• Develop and improve incident response playbooks and SOPs.

Detection, hunting, and platform logs

• Build and tune Splunk searches, alerts, dashboards, and reports; use SPL for investigation, hunting, and detection engineering.
• Reduce false positives, strengthen correlation logic, and onboard log sources while validating parsing and normalization.
• Manage Cribl Stream/Edge pipelines for log routing, filtering, enrichment, and normalization.
• Conduct hypothesis-driven hunts, map coverage to MITRE ATT&CK, identify gaps, and convert findings into detections.

Documentation and shift operations

• Conduct root cause analysis and prepare incident reports; maintain records of actions, evidence, and lessons learned.
• Support audit and compliance evidence requests and improve monitoring use cases and detection rules.
• Meet acknowledgement, triage, and escalation SLAs; work rotating day, evening, and night shifts, including weekends and public holidays, and complete shift handovers.

Required qualifications

• Bachelor’s degree in Computer Science, Information Security, Cybersecurity, or related field; equivalent experience and certifications may be considered instead.
• 5–8 years in security operations, incident response, or SOC monitoring, including at least 2 years at senior level.
• Hands-on Splunk Enterprise/Cloud, advanced SPL, and Cribl Stream/Edge pipeline experience.
• Incident investigation and full-lifecycle response experience, including evidence handling, escalation, playbooks/SOPs, and root cause analysis.
• Experience with Elastic Security EDR, Corelight NDR, and MITRE ATT&CK, Cyber Kill Chain, and Diamond Model.
• Knowledge of TCP/IP, DNS, HTTP/S, firewalls, proxies, IDS/IPS; proficiency in Windows and Linux.
• Proficiency in Python, Bash, or PowerShell; familiarity with OpenShift, OpenStack, Commvault, Scality, and related platform logs.
• Experience with ServiceNow, Jira, or equivalent case management.

Preferred qualifications

• Splunk Core Certified Power User or Splunk Certified Admin; Cribl Certified Admin; relevant GIAC certification; or BTL2/equivalent defensive certification.
• OpenStack and Kubernetes/OpenShift monitoring experience and familiarity with detection-as-code, version control, and peer review.

Working arrangement

• Full-time role in a 24x7 SOC with rotational day, evening, and night shifts, including weekends and public holidays.

Benefits

• Competitive salary package based on skills and experience, plus a performance-based yearly bonus.
• Discount cards, family health coverage including dental, vision, and life insurance, and access to learning platforms.