Senior Cyber IR Analyst: SOC Automation & Forensics

Saxo Bank; Aarhus; On-site; DKK 650,000 - 850,000; Full time

Job summary

Saxo Bank is seeking a passionate Cyber Security Analyst to help safeguard our digital assets in Copenhagen. You will focus on alert triage, incident response, and enhancing our SOC capabilities.

You will monitor security alerts, lead forensic investigations, and collaborate with threat intel and Insider Threat teams, stakeholders, and external partners to strengthen our security posture. The role emphasizes automation, playbooks, and continuous improvement.

Qualifications

• 5+ years of cybersecurity experience with a proactive and detail-oriented approach.
• Proficiency in forensics areas: binary triage, network logs, host forensics, or threat intel.
• Experience with SIEM/SOAR, endpoint security, and AI-enabled investigations; ServiceNow or similar ticketing.
• Familiarity with SOAR playbooks, automation, and alert tuning.
• Certifications such as CISSP, CISM, or SANS are advantageous.

Responsibilities

• Monitor and triage security alerts to keep our defences sharp.
• Lead forensic investigations to uncover, understand and mitigate threats.
• Collaborate with threat intelligence, Insider Threat team, stakeholders and external partners.
• Build dashboards and reports for the C-suite to maintain operational awareness.
• Mentor team members and conduct knowledge-sharing sessions.
• Contribute to automation, enhancements to detections and playbooks.
• Improve security controls and support Investigative triage for Insider Threat.

Skills

Cybersecurity forensics

Incident response

Security monitoring

Threat intelligence

Collaboration

Education

CISSP

CISM

SANS certifications

Tools

SIEM/SOAR platforms

Endpoint security platforms

ServiceNow

Job description

Saxo Bank is seeking a passionate Cyber Security Analyst to help safeguard our digital assets in Copenhagen. You will focus on alert triage, incident response, and enhancing our SOC capabilities.

You will monitor security alerts, lead forensic investigations, and collaborate with threat intel and Insider Threat teams, stakeholders, and external partners to strengthen our security posture. The role emphasizes automation, playbooks, and continuous improvement.