Security Operations Analyst (L1-L2)

Description

The company is hiring a Security Operations Analyst (L1-L2) for a full-time role on its team.

The team combines research, analysis and product development in fin-tech. It uses technical findings and data to shape new products, which the company still builds on today.

Responsibilities

• Watch prioritised alert queues and judge whether each alert points to real risk.
• Gather and connect context from endpoints, identities, logins, network, services, assets, users, timelines and the business to enrich cases.
• Run first-pass investigations, classify alerts, estimate preliminary severity and scope, and record evidence and reasoning in the case-management system.
• Close false positives and carry out approved low-risk actions.
• Escalate suspected incidents, privileged-account problems, and high-impact or production-impacting cases to L2, the manager or Incident Response.
• Write clear handover notes and help improve case quality and runbooks.

Requirements

• At least 1 year of hands-on commercial experience triaging security alerts, with one or more SIEM platforms, working knowledge of EDR/XDR, and case-management workflows.
• Able to write basic searches or queries, filter security events, and link activity across more than one data source, with experience in SIEM query languages such as KQL or EQL.
• Able to read common endpoint, identity, authentication, network, DNS, HTTP, and service or cloud audit telemetry at an initial-investigation level.
• Solid grounding in Windows, Linux, TCP/IP, DNS, HTTP, authentication, access control, and common attacks such as phishing, credential abuse, malware execution, and suspicious account activity.
• Able to tell true positives, false positives and benign activity apart, assign preliminary severity, identify affected users or assets, and spot when scope or impact is unclear.
• Basic use of indicators of compromise, reputation sources and threat-intelligence context, with awareness of the MITRE ATT&CK framework.
• Able to build a concise investigation timeline and document evidence, actions, conclusions, and handover or escalation notes in a case-management system.
• Plus: writing simple Python or PowerShell scripts for investigation and enrichment.
• Plus: exposure to cloud, email-security or SaaS audit logs and typical phishing-investigation workflows.
• Plus: hands-on cybersecurity labs or an entry-level certification such as Security+ or CySA+.
• Plus: experience with macOS.

Conditions

The role is full-time.

Benefits

• 20 paid vacation days a year.
• 10 paid sick leave days a year.
• Public holidays set by the company's approved holiday list.
• Medical budget.
• Option to work remotely.
• Professional education budget.
• Language learning budget.
• Wellness budget covering gym memberships, sports gear and related expenses.