Tier 1 Security Operations Center (SOC) Analyst

About us

NinjaOne unifies IT to simplify work for nearly 40,000 customers in 140+ countries

The NinjaOne Unified IT Operations Platform delivers endpoint management, autonomous patching, backup, and remote access in a single console to improve efficiency, increase resilience, and reduce spend. By automating IT and managing all endpoints, organizations give employees a great technology experience at work.

NinjaOne is obsessed with customer success and has retained a 98% customer satisfaction score for more than 5 years.

About the Role

We are seeking a Tier 1 SOC Analyst to join our Security Operations team in a nearshore capacity. This role is responsible for the initial monitoring, triage, and escalation of security alerts across cloud, endpoint, identity, and SaaS environments. The ideal candidate has strong foundational cybersecurity knowledge, excellent analytical skills, and the ability to clearly document and communicate findings to senior analysts and incident responders.

This position is well-suited for early-career security professionals looking to build hands-on experience in a modern, cloud-centric SOC.

Location: Germany or United Kingdom (Remote)

What You’ll Be Doing

• Monitor security alerts and events from SIEM, EDR, cloud security, email security, and identity platforms
• Perform initial triage and validation of alerts to determine severity, scope, and potential impact
• Distinguish true positives from false positives using documented playbooks and investigative techniques
• Escalate confirmed or high-risk incidents to Tier 2/DFIR teams with clear, structured documentation
• Collect and preserve initial artifacts (logs, indicators, timelines) to support incident response
• Follow established runbooks, escalation paths, and SLAs
• Maintain accurate case notes and ticket updates in the case management system
• Identify recurring alert patterns and contribute feedback for detection tuning and process improvements
• Participate in shift handoffs to ensure continuity of investigations
• Maintain awareness of common threat vectors (phishing, malware, credential abuse, cloud misconfigurations)

Required Qualifications

• 1–3 years of experience in a SOC, NOC, IT security, or related technical role
• Basic understanding of: Security monitoring and alert triage
• Networking fundamentals (TCP/IP, DNS, HTTP/S)
• Windows and/or macOS operating systems
• Common attack techniques (phishing, brute force, malware delivery)
• Experience working with at least one of the following: SIEM platforms (Splunk, Panther, Sentinel, QRadar, etc.)
• Endpoint detection and response (EDR/XDR) tools
• Cloud platforms (AWS, Azure, GCP) at a basic level
• Strong written English skills for documentation and escalation
• Ability to work effectively in a remote, distributed team environment
• Willingness to work scheduled shifts aligned with US business hours (including occasional weekends or on-call, if required)

Preferred Qualifications

• Hands-on experience triaging alerts in a production SOC environment
• Familiarity with MITRE ATT&CK framework
• Exposure to cloud-native security signals (CloudTrail, Azure AD logs, SaaS audit logs)
• Experience with ticketing systems (Jira, ServiceNow, etc.)
• Entry-level security certifications (one or more preferred, not required): Security+
• SSCP
• Blue Team Level 1 (BTL1)
• AWS Cloud Practitioner or equivalent

Key Skills

• Analytical thinking and attention to detail
• Ability to follow procedures while knowing when to escalate
• Clear written communication and structured documentation
• Calm, methodical approach during high-volume alert periods
• Strong curiosity and desire to grow into Tier 2 / DFIR responsibilities

What You’ll Love

• Flexible working days with unlimited PTO; balance your life and work.
• Grow personally and professionally with one of the fastest-growing companies.
• Access to our Corporate Benefits Platform (Expedia, FitX, Zalando, and more).
• Develop your skills through our renowned training platform.
• Competitive compensation.
• Collaborate with a curious, kind, international team.

#LI-CR1

#LI-Remote

All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, genetic information, marital status, veteran status, or any other status protected by applicable law. We are committed to providing an inclusive and diverse work environment.

Candidate Privacy

When you apply, NinjaOne collects and uses your personal information to review your application and manage the hiring process. To learn how we use, store, and protect your data, and what your rights are, please read our Candidate Privacy Policy at https://www.ninjaone.com/candidate-privacy-policy .

Where you can be based

This position is 100% remote and open to applicants based in Germany and United Kingdom.