AI-Enabled SOC Analyst I — Rapid Threat Response

AstraZeneca; Región Centro; Híbrido; MXN 520.000 - 900.000; Jornada completa

Descripción de la vacante

AstraZeneca in Mexico's Jalisco region seeks a seasoned SOC professional to validate AI-driven alerts, orchestrate rapid response, and ensure human judgment remains central while leveraging Sentinel, Defender and Copilot in investigations.

Join a high-ownership tech team and collaborate with global teams to refine detection logic, playbooks and automation, advancing security maturity while maintaining strong privacy and zero-trust controls.

Formación

• 4-7 years cybersecurity experience in regulated environments.
• Strong expertise in SIEM technologies (Microsoft Sentinel, Splunk, QRadar).
• Hands-on experience with Microsoft Defender XDR, CrowdStrike, Sentinel One, or similar EDR tools.
• Knowledge of Azure, AWS, and GCP security monitoring.
• Experience in incident response and digital forensics.
• Understanding of attack techniques, malware behaviour, and threat actor tactics.

Responsabilidades

• AI-Enabled Triage and Investigation: Validate AI-generated analysis, distinguish true positives from false positives and investigate alerts using Microsoft Sentinel, Microsoft Defender and SIEM platforms to drive timely, high-quality decisions.
• Incident Response Execution: Follow predefined runbooks/playbooks to handle standard alerts such as phishing, malware and login anomalies; elevate complex cases and initiate response actions aligned to zero-trust and privacy requirements.
• Security Copilot Governance: Manage human approval points for high-impact actions; critically evaluate Copilot-generated summaries, KQL queries and recommendations; craft structured prompts and reusable investigation instructions to improve accuracy and repeatability.
• Evidence and Forensics Support: Perform basic to intermediate malware analysis; analyze packet captures and network traffic; reconstruct timelines, scope incidents, identify affected entities and collect evidence to support root-cause analysis.
• SIEM Monitoring and Continuous Improvement: Monitor SIEM tools (e.g., Microsoft Sentinel, Splunk), ensure alerts are tracked and closed, maintain detailed activity logs and incident tickets, and contribute to refining detection logic and automation workflows.
• Shift Operations and Handover Excellence: Operate within a 24x7 SOC model, maintain meticulous shift handover notes and ensure seamless transitions so no alerts or incidents are missed.
• Stakeholder Communication: Communicate clearly with technical and business stakeholders, providing concise updates, actionable recommendations and post-incident insights that reduce risk and strengthen trust.

Conocimientos

SIEM expertise

Microsoft Sentinel

Zero-trust

Incident response

Digital forensics

Cloud security

Python/Powershell

Herramientas

Microsoft Defender XDR

CrowdStrike

SentinelOne

Splunk

QRadar

Azure security monitoring

Descripción del empleo

AstraZeneca in Mexico's Jalisco region seeks a seasoned SOC professional to validate AI-driven alerts, orchestrate rapid response, and ensure human judgment remains central while leveraging Sentinel, Defender and Copilot in investigations.

Join a high-ownership tech team and collaborate with global teams to refine detection logic, playbooks and automation, advancing security maturity while maintaining strong privacy and zero-trust controls.