Security Operations Analyst (SIEM Operations and Threat Detection)

Description

This is a senior consultant role in the company's security operations centre (CSOC), a team spread across several countries that protects varied and complex technology environments.

The work centres on improving threat detection and day-to-day security operations. It covers security content, quality checks on detections, the full life of detection use cases, connecting new security data sources, reporting, and refining processes.

The company is a global consulting group with more than 7,200 consultants in 21 countries, headquartered in Paris, with annual turnover of €850M. It has operated for 22 years and expects to reach €1 billion in revenue this year. Its clients span transport and logistics, financial services, energy and utilities, retail, and media and telecoms.

The role blends security operations, detection engineering, SIEM tuning, cyber risk and operational quality, and gives exposure to many security technologies.

Responsibilities

• Help build, test, tune, and maintain monitoring, analytics, and detection across SIEM, EDR, cloud, and other security platforms.
• Support the running and ongoing improvement of security monitoring and threat detection services.
• Take part in onboarding and testing new security data sources, telemetry feeds, and monitoring tools.
• Assist with managing security content, including use case lifecycles, rule reviews, testing, tuning, and quality checks.
• Work with threat intelligence, incident response, and operations teams to turn their needs into working detection and monitoring.
• Join architecture reviews of new or existing solutions, working under guidance, and suggest ways to improve monitoring and detection.
• Help prepare and keep up metrics, dashboards, KPIs, and service performance reports.
• Check detections, monitoring setups, processes, and service outputs for effectiveness, and spot where they can improve.
• Collect and review operational feedback to find ways to tune rules, cut false positives, and raise detection quality.
• Help with quality assurance: process reviews, control checks, service assessments, and corrective actions.
• Help write and maintain CSOC procedures, standards, documentation, knowledge base articles, and operating guides.
• Write and present technical reports, summaries, findings, and recommendations to internal and external stakeholders.

Requirements

• Be available for a rotating on-call shift, Monday to Sunday. This is mandatory.
• On call means you are on standby outside normal working hours. You must be reachable and able to log in to resolve critical incidents if they happen. You will not be working around the clock or on night shifts as a rule.
• A rotation typically covers one full week (7 consecutive days) every X months, depending on team size.
• 5+ years of experience in IT, including triaging alerts and supporting security incidents.
• Proven experience administering a SIEM platform, preferably Splunk or Microsoft Sentinel.
• Proven experience with the standard SOC toolset, such as SIEMs and EDRs, and the ability to analyse threats independently and work with the incident response team.
• Deep knowledge of Microsoft security tools, such as M365, Cloud App Security, Azure, Defender for Endpoint, Azure Security, Azure Sentinel, and XDR.
• Deep knowledge of cloud platforms such as Azure, AWS, and GCP.
• Deep knowledge of SIEM tools such as Splunk, QRadar, ArcSight, MS Sentinel, and the ELK Stack.
• Knowledge of at least one EDR solution, such as MS Defender for Endpoint or CrowdStrike.
• Knowledge of email security, network monitoring, and incident response.
• Knowledge of Linux, Mac, and Windows.
• C1 English.
• Experience designing SIEM architectures from initial design through to implementation, including data ingestion pipelines for varied log sources in cloud and on-premises environments.
• Proven knowledge of monitoring AWS environments across IaaS, SaaS, and PaaS.
• Knowledge of at least one general-purpose or shell scripting language, such as Ruby, Bash, PowerShell, or Python.
• Desirable certifications: MCSE, CCNA, Microsoft Azure (for example SC-200), GCIH, CEH, GCFA, or any GIAC or similar certification.
• Required soft skills: strong communication, customer-facing and oral communication skills, clear documentation and report writing, creative problem solving, willingness to learn on the job, and skill at managing conflict and cooperating with others.

Conditions

The role is fully remote.

It is a freelance, full-time contract.

On-call shifts run on a rotating schedule as described above.

The company is committed to non-discrimination on grounds including gender, race, and ideology, in line with its Equality Plan and Spanish gender equality rules (Royal Decree-Law 6/2019).

Benefits

• Training and career development.
• Work in a multicultural team on international projects.