Security Operations Analyst

About the role

This is a hands-on monitoring and investigation role: you'll triage and validate alerts, lead deep investigations across EDR, firewall, IPS, WAF, and SIEM tooling, and deliver clear, actionable findings and remediation guidance across our clients' environments, with clients owning execution of the actual response.

What you'll do

• Execute real-time monitoring and triage - monitor alerts across EDR, firewall, IPS, WAF, and SIEM platforms
• Maintain 24x7 shift coverage - deliver continuous threat monitoring as part of a rotating shift schedule including assigned nights, weekends, and holidays
• Conduct deep incident investigations - correlate telemetry across EDR, network, and cloud log sources to determine root cause, scope, and indicators of compromise
• Deliver remediation guidance - provide clear incident analysis and containment recommendations to client teams who own response execution within their environments
• Tune detection logic and rules - refine SIEM correlation rules and detection logic to eliminate false positives and close security coverage gaps

What you need

• 3–6 yrs of experience
• SIEM
• Incident response
• EDR
• Firewalls
• ISO 27001
• Splunk
• Any graduate

Good to have

• Python
• PowerShell