SOC Analyst

Andersen Lab; Osterreich; On-site; PEN 162,000 - 270,000; Full time

Benefits offered by this job

Private health insurance

Sports compensation

Mentoring & adaptation program

Referral program

Job summary

Andersen Lab is hiring a SOC Analyst to monitor security threats and protect critical systems in a complex international environment. The role involves investigating alerts across endpoint, network, email and identity, and coordinating with Incident Response to escalate confirmed incidents.

You will tune detections, write case notes and reports, and participate in shifts on a rotation. A strong background in cybersecurity and hands-on SIEM/EDR tools are essential.

Qualifications

• 4+ years in cybersecurity, including 1–2 years in a SOC at Tier 2 level.
• Hands-on with at least one major SIEM and at least one EDR/XDR tool.
• Investigation skills across endpoint, network, email and identity (incl. Microsoft 365 and Entra ID).
• Writing queries in KQL, SPL or equivalent.
• Working knowledge of MITRE ATT&CK and common attack techniques.
• Readiness for shift work and on-call rotation.

Responsibilities

• Investigating alerts escalated from L1/L2 across endpoint, network, email and identity.
• Deciding whether alerts are true incidents, assess scope and elevate confirmed incidents to Incident Response.
• Investigating email and identity threats in Microsoft 365 and Entra ID.
• Proposing detection tuning and new use cases to the SIEM team, based on investigation findings.
• Writing detailed case notes and periodic reports.
• Taking part in shifts and on-call rotation as defined in the request.

Skills

SOC experience

SIEM/EDR tools

Threat investigation

KQL/SPL queries

MITRE ATT&CK

Shift work

Tools

Microsoft Sentinel

Splunk

QRadar

Elastic

EDR/XDR tools

Job description

Summary

Andersen is hiring a SOC Analyst for a project providing cybersecurity services, monitoring security threats, and protecting critical systems in a complex international environment.

The customer is a large international organization that relies on modern technology and digital solutions to support its operations. Its activities involve secure IT infrastructure, data management, digital services, and the adoption of emerging technologies to improve operational efficiency and reliability.

The project is focused on providing cybersecurity and digital services for international organizations within a complex multi-tenant environment. It includes cyber defense operations, security incident management, and continuous protection of critical systems and services to ensure secure and reliable operations worldwide.

Responsibilities

• Investigating alerts escalated from L1/L2 across endpoint, network, email and identity.
• Deciding whether alerts are true incidents, assess scope and elevate confirmed incidents to Incident Response.
• Investigating email and identitying threats in Microsoft 365 and Entra ID (phishing, suspicious sign-ins, account compromise).
• Proposing detection tuning and new use cases to the SIEM team, based on investigation findings.
• Writing detailed case notes and periodic reports.
• Taking part in shifts and on-call rotation as defined in the request.

Requirements

• Experience in cybersecurity for 4+ years, including 1-2 years in a SOC at Tier 2 level.
• Hands-on work with at least one major SIEM (Microsoft Sentinel, Splunk, QRadar or Elastic) and at least one EDR/XDR tool.
• Investigation skills across endpoint, network, email and identity (including Microsoft 365 and Entra ID).
• Writing queries in KQL, SPL or equivalent.
• Working knowledge of MITRE ATT&CK and common attack techniques.
• Readiness for shift work and on-call rotation.
• Clean record, ready for background verification.
• Level of English – from Upper-Intermediate and above.

Desired skills

• Certifications: CySA+, SC-200, BTL1/BTL2, GCIH.
• Threat hunting experience.
• MSSP or multi-tenant SOC experience.
• SOAR experience.
• Network traffic analysis (Wireshark, Zeek, IDS/IPS).
• Scripting in Python or PowerShell.

Reasons to join us

• Experience in teamwork with leaders in FinTech, Healthcare, Retail, Telecom, and others. Andersen cooperates with such businesses as Samsung, Siemens, Johnson & Johnson, BNP Paribas, Ryanair, Mercedes, TUI, Verivox, Allianz, T-Systems, etc..
• The opportunity to change the project and/or develop expertise in an interesting business domain.
• Guarantee of professional, financial, and career growth! The company has introduced systems of mentoring and adaptation for each new employee.
• The opportunity to earn up to an additional 1,000 EUR per month, depending on the level of expertise, which will be included in the annual bonus, by participating in the company's activities.
• Access to the corporate training portal, where the entire knowledge base of the company is collected and which is constantly updated.
• Referral program.
• Private health insurance and sports compensation, depending on the type of employment.

Locations

Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Hungary, Italy, Latvia, Lithuania, Luxembourg, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, The Netherlands