SOC L1 Analyst - Hybrid Madrid

UST España & Latam; Madrid; On-site; EUR 32,000 - 48,000; Full time

Benefits offered by this job

Annual leave 23 days

Teleworking compensation

Life and Accident Insurance

Training platforms access

Career plans

Referral bonuses

Flexible payment schedule (12 or 14)

WFH or remote work policy

Job summary

UST in Madrid seeks a SOC L1 Analyst to join its Security Operations Center. You will monitor security events, perform initial triage, and escalate to L2/L3 according to procedures. The role requires working a 24/7 rotation, including nights and weekends.

Ideal candidates have a solid cybersecurity foundation, hands-on SOC experience, and strong English and Spanish language skills (C1). You will work with SIEM, EDR, and cloud/security platforms in a multinational environment.

Qualifications

• Strong understanding of cybersecurity principles and incident response.
• Knowledge of common threats: phishing, malware/ransomware, unauthorized access, web-based attacks.
• Solid networking basics: TCP/IP, DNS, HTTP/HTTPS, VPNs, firewalls/proxies.
• Familiarity with Windows and Linux, and security data sources across endpoints, networks, identity, and cloud.
• Ability to interpret logs, correlate events, and follow incident lifecycle procedures.

Responsibilities

• Monitor security events from SIEM/EDR and other monitoring platforms.
• Perform first-line triage, investigate alerts, and classify incidents.
• Escalate high-severity incidents to L2/L3 per SOPs and SLAs.
• Create and manage incident tickets with evidence and actions taken.
• Follow incident response procedures and runbooks; perform IOC lookups.
• Review events from multiple sources and correlate activity across environments.
• Execute containment actions as per playbooks and monitor SLA timelines.
• Participate in shift handovers and report gaps or recurring false positives.

Skills

Cybersecurity basics

Security monitoring

Incident response

Phishing

Malware and ransomware

Unauthorized access

Web-based attacks

Networking concepts

TCP/IP

DNS

HTTP/HTTPS

VPNs

Firewalls and proxies

Windows

Linux

Endpoint security

Cloud security

MITRE ATT&CK

Cyber Kill Chain

Ticketing systems

IT service management

Education

Bachelor’s degree in Cybersecurity

2–3 years SOC L1 experience

Tools

Microsoft Sentinel

Splunk

IBM QRadar

Google Chronicle

CrowdStrike Falcon

SentinelOne

VMware Carbon Black

Trend Micro Vision One

Job description

We are still looking for the very Top Talent…and we would be delighted if you were to join our team!

More in details, UST is a multinational company based in North America, certified as a Top Employer and Great Place to Work company with over 35.000 employees all over the world and presence in more than 35 countries. We are leaders on digital technology services, and we provide large-scale technologic solutions to big companies.

What we look for?

We are looking for 3 SOC L1 Analyst to join our Security Operations Center team in Madrid.

The SOC L1 Analyst will act as the first line of defense, continuously monitoring security s, performing initial investigations, validating potential threats, documenting findings, and escalating confirmed or complex incidents to L2/L3 analysts according to established procedures and SLA requirements.

Availability:

Candidates must be willing to work in a 24/7 rotational shift environment, including nights, weekends, and holidays.

Key Responsibilities:

Monitor security s and events generated by SIEM, EDR, email security, firewall, cloud security, and other security monitoring platforms.

Perform first-level triage and investigation of security s.Analyze logs and security events to identify potentially malicious or suspicious activity.

Validate s and classify them as true positives, false positives, or requiring further investigation.

Prioritize and elevate confirmed, high-severity, or complex incidents to L2/L3 analysts according to defined escalation procedures.

Create, update, and manage incident tickets, including accurate investigation notes, evidence, findings, and actions taken.

Follow established SOPs, runbooks, playbooks, and incident response procedures.

Perform IOC lookups using approved internal and external threat intelligence sources.

Review and correlate events from multiple sources, including endpoint, network, identity, email, and authentication logs.

Execute predefined containment or response actions when authorized by established playbooks.

Ensure s and incidents are acknowledged, investigated, and escalated within established SLA timelines.

Participate in shift handovers and ensure the smooth transition of active cases to the next team.

Report monitoring gaps, tool issues, procedural inconsistencies, and recurring false-positive s to senior analysts or the team lead.

Support the preparation of operational reports, incident summaries, and customer review documentation.

Clearly communicate incident status and investigation findings to internal teams and relevant stakeholders.

Work effectively in a 24/7 shift-based SOC environment.

Mandatory requirements:

Good understanding of cybersecurity principles, security monitoring, and incident response.

Knowledge of common cyber threats, including:

• Phishing
• Malware and ransomware
• Unauthorized access
• Web-based attacks

Understanding of networking concepts, including:

• TCP/IP
• DNS
• HTTP/HTTPS
• Ports and protocols
• VPNs
• Firewalls and proxies

Familiarity with Windows and Linux operating systems.

Knowledge of endpoint, network, email, identity, and cloud security.

Ability to interpret logs and correlate events from multiple security data sources.

Understanding of the security incident lifecycle, including detection, triage, documentation, escalation, and closure.

Awareness of the Cyber Kill Chain and MITRE ATT&CK framework.

Familiarity with ticketing systems and IT service management processes.

Security Tools

Hands-on experience or working knowledge of one or more of the following would be highly valuable:

SIEM Platforms

• Microsoft Sentinel
• Splunk
• IBM QRadar
• Google Chronicle

EDR & Endpoint Security Platforms

• CrowdStrike Falcon
• SentinelOne
• VMware Carbon Black
• Trend Micro Vision One

Candidates should have practical experience navigating security dashboards, reviewing s, performing searches and filtering, investigating endpoint activity, and documenting investigation findings.

Education & Experience

• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, Electronics, or a related field.
• 2–3 years of professional SOC L1 experience.
• Candidates should have a professional background specifically focused on Security/SOC.
• We are looking for candidates who have built their experience within cybersecurity rather than professionals who have only recently transitioned into SOC from another technical domain.
• Hands‑on experience investigating and triaging SOC s and monitoring customer security queues is required.
• English and spanish: C1 level

Nice to Have:

Any of the following certifications would be considered an advantage:

• CompTIA Security+
• Microsoft Certified: Security Operations Analyst Associate (SC-200)
• ISC2 Certified in Cybersecurity (CC)
• CompTIA CySA+
• Other equivalent cybersecurity certifications

What can we offer?

• 23 days of Annual Leave plus the 24th and 31st of December as discretionary days!
• Numerous benefits (Heath Care Plan, teleworking compensation, Life and Accident Insurances).
• Free access to several training platforms
• Professional stability and career plans
• UST also, compensates referrals from which you could benefit when you refer professionals.
• The option to pick between 12 or 14 payments along the year.
• Real Work Life Balance measures (flexibility, WFH or remote work policy, compacted hours during summertime…)
• UST Club Platform discounts and gym Access discounts

If you would like to know more, do not hesitate to apply and we’ll get in touch to fill you in details. UST is waiting for you!

In UST we are committed to equal opportunities in our selection processes and do not discriminate based on race, gender, disability, age, religion, sexual orientation or nationality. We have a special commitment to Disability & Inclusion, so we are interested in hiring people with disability certificate.