Security Operations Analyst (SIEM Operations and Threat Detection)

Description

You would join the company's Cyber Security Operations Center (CSOC) as a senior consultant. The CSOC is a globally distributed team of cybersecurity professionals protecting complex and varied technology environments.

The work centres on improving threat detection and SOC operations through detection content, quality checks and validation, the full lifecycle of detection use cases, onboarding new security data sources, reporting and process improvement.

The role mixes security operations, detection engineering, SIEM tuning, cyber risk management and operational excellence, and gives exposure to many security technologies and customer environments.

The company is an international consulting group focused on innovation and business transformation through technology. It has over 7,200 consultants in 21 countries, a turnover of €850M, and is headquartered in Paris. It has operated for 22 years and is on track to reach €1 billion in revenue this year. Its areas include data and technology, cloud and application services, and management consulting, with clients in transport and logistics, financial services, energy and utilities, retail, and media and telecoms.

Responsibilities

• Help build, implement, validate, tune and maintain monitoring, analytics and detection across SIEM, EDR, cloud and other security platforms.
• Support the running and continuous improvement of security monitoring and threat detection services.
• Take part in onboarding, integrating, testing and validating security data sources, telemetry feeds and monitoring.
• Manage security content, including the use case lifecycle, rule reviews, testing, tuning and content quality checks.
• Work with threat intelligence, incident response and SOC operations teams to turn operational and threat intelligence needs into working detections and monitoring.
• Under guidance, join architecture reviews of new or existing solutions and recommend ways to strengthen monitoring and detection.
• Prepare and maintain SOC metrics, dashboards, KPIs and service performance reports.
• Assess how well detections, monitoring setups, processes and service outputs perform, and identify where they can improve.
• Use operational feedback to tune detections, reduce false positives and raise overall detection quality.
• Support quality assurance, including process reviews, control checks, service quality assessments and corrective actions.
• Write and update CSOC procedures, standards, documentation, knowledge base articles and operating guidance.
• Prepare and present technical reports, summaries, findings and recommendations to internal and external stakeholders.

Requirements

• 5+ years in IT, including alert triage and supporting security incidents.
• Proven experience administering a SIEM platform, ideally Splunk or Microsoft Sentinel.
• Proven hands-on use of common SOC tools such as SIEMs and EDRs, with the ability to analyse security threats independently and work alongside the incident response team.
• Deep knowledge of Microsoft security tools, such as M365, Cloud App Security, Azure, Defender for Endpoint, Azure Security, Azure Sentinel and XDR.
• Deep knowledge of cloud technologies such as Azure, AWS and GCP.
• Deep knowledge of SIEM tools such as Splunk, QRadar, ArcSight, MS Sentinel and ELK Stack.
• Knowledge of at least one EDR solution, such as MS Defender for Endpoint or CrowdStrike.
• Knowledge of email security, network monitoring and incident response.
• Knowledge of Linux, Mac and Windows.
• C1 English proficiency.
• Experience designing SIEM architectures from initial design through to implementation, including data ingestion pipelines for varied log sources across cloud and on-premises environments.
• Proven knowledge of monitoring AWS environments across IaaS, SaaS and PaaS.
• Knowledge of at least one general-purpose or shell scripting language, such as Ruby, Bash, PowerShell or Python.
• Excellent communication skills, including customer-facing and spoken communication.
• Ability to write documentation and reports.
• Creative in finding innovative solutions.
• Willing to learn on the job.
• Able to manage conflict and cooperate well with others.
• Desirable (optional): MCSE, CCNA, Microsoft Azure (e.g. SC-200), GCIH, CEH, GCFA or any GIAC or similar certification.

Conditions

Remote position.

Freelance, full-time contract.

Mandatory rotating on-call shift covering Monday to Sunday. You are on standby outside standard working hours and must be reachable to log in and resolve critical incidents only if they arise. You will not be working around the clock or on late-night shifts.

Rotation is approximately one full week (7 consecutive days) every X months, depending on the number of team members.

The company is committed to non-discrimination based on gender, race, ideology or any other reason, in line with its Equality Plan and Spanish equality rules (Royal Decree-Law 6/2019).

Benefits

• Training and career development.
• Work in a multicultural team on international projects.