SOC Specialist

SCRYPT; Schweiz; Híbrido; CHF 83.000 - 120.000; Jornada completa

Ventajas ofrecidas por este puesto de trabajo

Hybrid role in Malta

Direct work with CISO

Ownership from day one

Descripción de la vacante

SCrypt is seeking a SOC Specialist to build, operate, and mature detection and response capabilities. You will design detection logic, respond to incidents, integrate log sources, manage escalations, and shape security posture in a lean, high-impact team.

The role requires hands-on incident response, strong MITRE ATT&CK knowledge, and deep experience with Microsoft Sentinel and Defender XDR. Hybrid role based in Malta with European hours.

Formación

• Hands-on SOC experience with SIEM tooling
• Deep expertise with Microsoft Sentinel as primary SIEM
• Strong Defender XDR proficiency
• Advanced KQL detection rule authoring and analytics
• Experience onboarding and normalizing log sources
• Incident response leadership and execution
• Knowledge of MITRE ATT&CK and modern adversary techniques
• Experience with alert escalation and communicating findings under pressure
• Familiarity with ISO 27001 or NIST frameworks
• Fluent English communication (written and spoken)

Responsabilidades

• Monitor, analyze, and investigate security events across Microsoft Sentinel and Defender XDR
• Lead end-to-end incident response: triage, containment, eradication, post-incident reviews
• Write, tune, and optimize KQL-based detections and analytics
• Onboard and maintain log sources across endpoints, identity, cloud, and network
• Own alert escalation workflows and ensure timely handoffs to stakeholders
• Map attacker behavior to MITRE ATT&CK and drive threat-informed detection
• Perform proactive threat hunting based on intelligence and signals
• Develop SOC automation workflows to reduce alert fatigue
• Create and maintain SOC playbooks, runbooks, and escalation procedures
• Translate technical findings for executive and non-technical audiences
• Collaborate with IT/DevOps/engineering to strengthen security posture

Conocimientos

Microsoft Sentinel

Microsoft Defender XDR

KQL

Incident response

MITRE ATT&CK

Log source onboarding

Threat hunting

SOC automation

Communication

English proficiency

Herramientas

SOAR platforms

Logic Apps

Custom scripting

Descripción del empleo

SCRYPT is where money moves: across borders and currencies, on-chain and off. One platform brings together payments, trading, custody and asset management, connecting stablecoin and fiat rails for institutions that move money at scale. Clients are supported by a human desk that runs 24/7.

SCRYPT is a multi-jurisdictional licensed platform headquartered in Switzerland. Licensing and entity information: scrypt.swiss/regulatory.

About the Role

We are hiring a SOC Specialist based in Europe to help build, operate, and mature our detection and response capabilities from the ground up. This is a high-impact, high-autonomy position embedded within a lean security team at an institutional crypto trading firm operating under Swiss regulatory standards.

You will work directly with the CISO to design detection logic, respond to real incidents, integrate log sources, manage escalations, and shape the security posture of a fast-moving organization. This is not a passive monitoring role – we need someone who investigates, builds, and improves.

The Bar

Small team, senior bar, AI-native by default. We hire builders who ship, not managers who maintain. One great hire beats three average ones, so we hold the bar even when the seat is empty. Ownership from week one. Velocity from day one. If you need a long runway before you contribute, this isn’t the role.

Key Responsibilities

• Monitor, analyze, and investigate security events across Microsoft Sentinel (SIEM) and Defender XDR
• Lead incident response activities end to end – triage, investigation, containment, eradication, and post-incident review
• Write, tune, and optimize KQL-based detection rules and analytic use cases
• Onboard and maintain log sources – ensuring visibility across endpoints, identity, cloud, and network layers
• Own alert escalation workflows and ensure timely, accurate handoff to relevant stakeholders
• Map attacker behavior to the MITRE ATT&CK framework and drive threat-informed detection
• Conduct proactive threat hunting based on hypotheses, intelligence feeds, and environmental signals
• Build and improve SOC automation workflows to reduce alert fatigue and accelerate response
• Develop and maintain SOC playbooks, runbooks, and escalation procedures
• Translate technical findings into clear communication for executive and non-technical audiences
• Collaborate closely with IT, DevOps, and engineering teams to strengthen the overall security posture

Requirements

• Minimum 3 years of hands-on experience in a SOC environment
• Proven, deep expertise with Microsoft Sentinel (Azure Sentinel) as a primary SIEM platform
• Strong proficiency in Microsoft Defender XDR
• Advanced KQL skills – detection rule authoring, query optimization, and custom analytics
• Solid experience with log source integration – onboarding, parsing, normalization, and troubleshooting ingestion pipelines
• Demonstrated ability to lead or independently execute incident response investigations
• Strong understanding of the MITRE ATT&CK framework and modern adversary techniques
• Experience managing alert escalation processes and communicating findings under pressure
• Working knowledge of information security frameworks such as ISO 27001 or NIST
• Fluent English – clear, professional written and verbal communication
• Optional: Experience with SOC automation using SOAR platforms, Logic Apps, or custom scripting; Background in crypto, fintech, or regulated financial services environments; Familiarity with Swiss or EU regulatory frameworks (DORA, FINMA, MiCA); Threat intelligence integration and operationalization experience

What we offer

• Build the SOC from the ground up – real ownership, real impact
• Work directly with the CISO in a lean, expert-level security team
• Institutional crypto OTC trading – a unique threat landscape with complex, high-stakes operations
• Hybrid role based in Malta with flexibility within European hours

Next Steps

If you are passionate about security systems and supporting dynamic teams we would love to hear from you!