SOC Analyst

Описание The project provides cybersecurity and digital services to international organizations in a complex multi-tenant environment. It includes cyber defense operations, security incident management, and continuous protection of critical systems and services.

Задачи • Investigate alerts escalated from L1/L2 across endpoint, network, email, and identity • Determine whether alerts are true incidents, assess their scope, and escalate confirmed incidents to Incident Response • Investigate email and identity threats in Microsoft 365 and Entra ID, including phishing, suspicious sign-ins, and account compromise • Propose detection tuning and new use cases to the SIEM team based on investigation findings • Write detailed case notes and periodic reports • Participate in shifts and on-call rotation as defined in the request

Требования • At least 4 years of cybersecurity experience, including 1–2 years in a Tier 2 SOC • Hands-on experience with at least one major SIEM and at least one EDR/XDR tool • Investigation skills across endpoint, network, email, and identity, including Microsoft 365 and Entra ID • Ability to write queries in KQL, SPL, or equivalent • Working knowledge of MITRE ATT&CK and common attack techniques • Readiness for shift work and on-call rotation • Clean record and readiness for background verification • Upper-Intermediate English or above • Будет плюсом: CySA+, SC-200, BTL1/BTL2, or GCIH certifications, threat hunting experience, MSSP or multi-tenant SOC…