SOC L1 Analyst — 24/7 Security Monitoring Expert

UST España & Latam; Madrid; On-site; EUR 32,000 - 48,000; Full time

Benefits offered by this job

Annual leave 23 days

Teleworking compensation

Life and Accident Insurance

Training platforms access

Career plans

Referral bonuses

Flexible payment schedule (12 or 14)

WFH or remote work policy

Job summary

UST in Madrid seeks a SOC L1 Analyst to join its Security Operations Center. You will monitor security events, perform initial triage, and escalate to L2/L3 according to procedures. The role requires working a 24/7 rotation, including nights and weekends.

Ideal candidates have a solid cybersecurity foundation, hands-on SOC experience, and strong English and Spanish language skills (C1). You will work with SIEM, EDR, and cloud/security platforms in a multinational environment.

Qualifications

• Strong understanding of cybersecurity principles and incident response.
• Knowledge of common threats: phishing, malware/ransomware, unauthorized access, web-based attacks.
• Solid networking basics: TCP/IP, DNS, HTTP/HTTPS, VPNs, firewalls/proxies.
• Familiarity with Windows and Linux, and security data sources across endpoints, networks, identity, and cloud.
• Ability to interpret logs, correlate events, and follow incident lifecycle procedures.

Responsibilities

• Monitor security events from SIEM/EDR and other monitoring platforms.
• Perform first-line triage, investigate alerts, and classify incidents.
• Escalate high-severity incidents to L2/L3 per SOPs and SLAs.
• Create and manage incident tickets with evidence and actions taken.
• Follow incident response procedures and runbooks; perform IOC lookups.
• Review events from multiple sources and correlate activity across environments.
• Execute containment actions as per playbooks and monitor SLA timelines.
• Participate in shift handovers and report gaps or recurring false positives.

Skills

Cybersecurity basics

Security monitoring

Incident response

Phishing

Malware and ransomware

Unauthorized access

Web-based attacks

Networking concepts

TCP/IP

DNS

HTTP/HTTPS

VPNs

Firewalls and proxies

Windows

Linux

Endpoint security

Cloud security

MITRE ATT&CK

Cyber Kill Chain

Ticketing systems

IT service management

Education

Bachelor’s degree in Cybersecurity

2–3 years SOC L1 experience

Tools

Microsoft Sentinel

Splunk

IBM QRadar

Google Chronicle

CrowdStrike Falcon

SentinelOne

VMware Carbon Black

Trend Micro Vision One

Job description

UST in Madrid seeks a SOC L1 Analyst to join its Security Operations Center. You will monitor security events, perform initial triage, and escalate to L2/L3 according to procedures. The role requires working a 24/7 rotation, including nights and weekends.

Ideal candidates have a solid cybersecurity foundation, hands-on SOC experience, and strong English and Spanish language skills (C1). You will work with SIEM, EDR, and cloud/security platforms in a multinational environment.