Second Line Security Event Analyst

Vector Synergy; Brussel; On-site; EUR 60,000 - 90,000; Full time

Job summary

Hunter International, Inc. is seeking an experienced cyber security analyst to join our security operations team and support the review of investigations, escalation handling, and evidence gathering to meet CSOC standards.

The role emphasizes hands-on log analysis, threat triage across SIEM/SOAR platforms, and technical escalation for monitoring in Azure, AWS, and hybrid environments.

Qualifications

• Experience designing, developing, and maintaining detection rules, alerts, and analytics across SIEM, EDR/XDR, and cloud tools.
• Mentor analysts and provide feedback on investigation quality and reporting standards.
• Experience with automation or SOAR, identifying repetitive tasks and improving workflows.
• Experience in regulated, high-control environments (defence, government, financial services, etc.).
• Hands-on with cloud-native security monitoring in Azure and AWS, in hybrid environments.
• Experience developing detections from network and edge devices (Cisco, Fortinet, Palo Alto, etc.)

Responsibilities

• Reviewing and validating investigations, supporting First-Line Analysts to ensure that alert closures, escalations, supporting evidence, and investigation notes meet CSOC quality standards, while confirming completeness, accuracy, and procedural compliance.
• Acting as the technical escalation point for cyber security monitoring.
• Performing in-depth log analysis and threat triage using SIEM and SOAR platforms, including Splunk Enterprise Security, Splunk SOAR, Microsoft Sentinel, and supporting security tools and data sources.

Skills

SIEM

EDR/XDR

Cloud security

Automation / SOAR

Mentoring analysts

Regulated environments

Cloud-native monitoring

Network/Edge detections

Tools

Splunk

Microsoft Sentinel

Azure

AWS

Cisco

Fortinet

Palo Alto

Splunk Enterprise Security

Job description

• Experience in designing, developing and maintaining detection rules, alerts and analytics across SIEM, EDR/XDR and cloud security tools (e.g., Splunk, Microsoft Sentinel, Azure, AWS) ;
• Experience supporting or mentoring less-experienced analysts, providing constructive feedback on investigation quality and reporting standards ;
• Practical experience with automation or SOAR use cases, identifying repetitive manual tasks and creating enrichment or workflow improvements.
• Experience working in a regulated , high control environment such as defence , government , financial services or other enterprise sectors ;
• Hands on experience with cloud native security monitoring ( Azure , AWS) and hybrid environments ;
• Experience with developing detections from network and Edge security devices such as Cisco, Fortinet / Fortigate , Palo Alto , or comparable appliances .

Duties/role:

Reviewing and validating investigations, supporting First-Line Analysts to ensure that alert closures, escalations, supporting evidence, and investigation notes meet CSOC quality standards, while confirming completeness, accuracy, and procedural compliance ;

Acting as the technical escalation point for cyber security monitoring ;

Performing in-depth log analysis and threat triage using SIEM and SOAR platforms, including Splunk Enterprise Security, Splunk SOAR, Microsoft Sentinel, and supporting security tools and data sources.