Security Operations Analyst (L1/L2)

We are inviting you, a highly motivated and results-oriented Security Operations Analyst to join our team on a full-time basis.

Our team has unique expertise in research, analysis, and product development. By relying on technical insights and a data-driven approach, we create disruptive future-defining innovations of the fin-tech industry that remain our basis for success.

Responsibilities

• Monitor prioritized security alert queues and validate whether alerts indicate genuine security risks.
• Perform initial and in-depth investigations of security alerts and suspected incidents across endpoint, identity, authentication, network, cloud, and other relevant environments.
• Enrich investigations by correlating endpoint, identity, authentication, network, service, asset, user, timeline, and business context from multiple data sources.
• Classify security events, assess severity and potential impact, identify affected users and assets, and determine the scope of suspicious activity.
• Develop investigation timelines, collect relevant evidence, identify potential attack techniques, and document findings and conclusions in the case-management system.
• Close false positives and benign activity with appropriate justification, and execute approved low-risk response actions through established runbooks.
• Escalate complex or high-impact incidents, privileged-account compromises, and production-impacting cases to the appropriate teams or Incident Response.
• Conduct proactive threat hunting and investigate suspicious activity that may not have triggered existing security detections.
• Identify recurring false positives, detection gaps, and opportunities to improve alert quality, investigation procedures, and operational efficiency.
• Maintain clear investigation records, handover notes, and contribute to the continuous improvement of SOC processes and runbooks.

Requirements

• At least 1+ year of hands-on experience in security operations, including security alert triage and incident investigation, with practical exposure to SIEM, EDR/XDR, and case-management platforms.
• Ability to build searches and queries, filter security events, and correlate related activity across multiple data sources using SIEM query languages such as KQL, EQL, ES|QL, or SPL.
• Understanding of common endpoint, identity, authentication, network, DNS, HTTP, cloud, and service audit telemetry.
• Working knowledge of Windows and Linux operating systems, TCP/IP, DNS, HTTP, authentication mechanisms, access control, and common attack techniques.
• Ability to distinguish true positives, false positives, and benign activity; assess preliminary severity; identify affected users and assets; and determine when further investigation or escalation is required.
• Understanding of common attack patterns, including phishing, credential abuse, malware execution, privilege escalation, lateral movement, and suspicious account activity.
• Basic knowledge of Indicators of Compromise (IOCs), threat intelligence, reputation sources, and the MITRE ATT&CK framework.
• Ability to conduct structured investigations, build concise incident timelines, correlate evidence, and document investigation findings, actions, conclusions, and escalation notes.
• Understanding of incident response fundamentals, including containment, eradication, and recovery, as well as the importance of following established response procedures.
• Good analytical thinking, attention to detail, and the ability to communicate technical findings clearly.

Will be a plus

• Simple Python or PowerShell scripts for investigation and enrichment
• Exposure to cloud, email-security, or SaaS audit logs and common phishing-investigation workflows
• Practical cybersecurity labs or an entry-level certification such as Security+ or CySA+
• Experience with MacOS

We offer

• 20 paid vacation days per year
• 10 paid sick leave days per year
• Public holidays as per the company's approved Public holiday list
• Medical budget
• Opportunity to work remotely
• Professional education budget
• Language learning budget
• Wellness budget (gym membership, sports gear and related expenses)

Where you can be based

This position is 100% remote and open to applicants based in these 49 countries: Andorra, Albania, Austria, Åland Islands, Bosnia and Herzegovina, Belgium, Bulgaria, Switzerland, Cyprus, Czechia, Germany, Denmark, Estonia, Spain, Finland, Faroe Islands, France, United Kingdom, Guernsey, Gibraltar, Greece, Croatia, Hungary, Ireland, Isle of Man, Iceland, Italy, Jersey, Liechtenstein, Lithuania, Luxembourg, Latvia, Monaco, Moldova, Montenegro, North Macedonia, Malta, Netherlands, Norway, Poland, Portugal, Romania, Serbia, Sweden, Slovenia, Slovakia, San Marino, Ukraine and Vatican City.