Security Operations Center Analyst

Auxis; Bogotá; On-site; COP 60,000,000 - 100,000,000; Full time

Job summary

Grant Thornton's Cyber Fusion Centre (CFC) in Bogotá seeks a Sr. SOC Analyst to own the incident lifecycle end to end, from initial alert triage to containment and continuous improvement.

You will leverage CrowdStrike Falcon Next-Gen SIEM/EDR to analyze detections, perform malware and PCAP analyses, and coordinate remediation with IT and IAM teams in a follow-the-sun model.

Qualifications

• Bachelor's degree in Computer Science, Cybersecurity, Information Security, or equivalent.
• 2+ years in security operations, SOC monitoring, SIEM/EDR, incident response, or related cybersecurity role.
• CCSA, CySA+, or similar SOC/Forensics certifications preferred.

Responsibilities

• End-to-End Incident Ownership: manage full incident lifecycle, from monitoring to closure.
• Advanced Threat Detection: analyze detections with CrowdStrike Falcon Next‑Gen SIEM/EDR.
• Malware & Traffic Analysis: perform static/dynamic analysis on malware samples and PCAPs to extract IOCs.
• Incident Response & Remediation: execute IR plans and support containment/eradication with IT teams.
• Threat Hunting & SOC Improvement: identify vulnerabilities and improve runbooks and rules.

Skills

CrowdStrike

SIEM/EDR

SOAR

ServiceNow

MITRE ATT&CK

Education

Bachelor's degree

Tools

CrowdStrike Falcon

ServiceNow

SOAR

Job description

Sr. Security Operations Center (SOC) Analyst

Grant Thornton's Cyber Fusion Centre (CFC) is actively seeking a technically strong and motivated Sr. SOC Analyst to join our follow-the-sun security operations team. Operating in a "tierless" SOC model, you will have end-to-end ownership of the security operations lifecycle - from initial alert review and triage through investigation, containment, and continuous improvement.

What You Will Do

• End-to-End Incident Ownership: Manage the full incident lifecycle, including real-time monitoring, triage, evidence review, response coordination, and closure.
• Advanced Threat Detection: Utilize CrowdStrike Falcon Next-Gen SIEM to analyze first- and third-party detections, correlate events, and execute query-based analysis.
• Malware & Traffic Analysis: Perform static/dynamic analysis on malware samples and PCAPs to extract network Indicators of Compromise (IOCs).
• Incident Response & Remediation: Execute Cybersecurity Incident Response Plans, support containment/eradication efforts, and collaborate with IT resolver, IAM, and infrastructure teams.
• Threat Hunting & SOC Improvement: Identify vulnerabilities and control weaknesses, validate detections, and recommend logic improvements to SOC runbooks and correlation rules.

What You Bring

• Experience: 2+ years in security operations, SOC monitoring, SIEM/EDR, incident response, or a related cybersecurity role (MDR/MSSP or enterprise environment preferred).
• Technical Proficiency: Strong hands-on experience with CrowdStrike Falcon Next-Gen SIEM/EDR and case management platforms like ServiceNow. Familiarity with SOAR orchestration automation.
• Analytical Skills: Deep understanding of the MITRE ATT&CK framework, incident response lifecycles, and root cause analysis. Ability to make calm, structured decisions under pressure.
• Education: Bachelor’s degree in Computer Science, Cybersecurity, Information Security, or equivalent practical operations experience.
• Certifications (Preferred): CrowdStrike Certified SIEM Analyst (CCSA), CompTIA CySA+, or similar SOC/Forensics certifications.