Cybersecurity SOC Analyst

Kognitiv Inc.; Polska; In loco; PLN 130.000 - 170.000; Tempo pieno

Descrizione del lavoro

Kognitiv Inc. is hiring a Cybersecurity SOC Analyst to investigate security alerts, improve detection rules and monitor how sensitive data moves across our environment. The role supports global security with European time-zone coverage alongside North America.

This hands-on position focuses on SIEM platforms and data loss prevention, not audits or identity governance, reporting to Ousmane Ndiaye and collaborating day-to-day on security operations.

Competenze

• Hands-on SOC analyst experience with alerts and incidents.
• Experience using SIEM platforms in real investigations.
• Knowledge of DLP tools and data loss investigations.

Mansioni

• Monitor, triage and investigate security alerts across logs from firewalls, endpoints and devices.
• Write and tune detection rules to correlate events and automate triage.
• Review DLP events to identify inappropriate data transfers.
• Follow up with teams to investigate security concerns.
• Apply understanding of IT and cloud tech to distinguish suspicious from expected activity.
• Track threats and vulnerabilities and contribute to playbooks.

Conoscenze

SOC analysis

SIEM usage

DLP tools

Scripting (Python/KQL/SPL/LEQL)

EDR experience

IT systems & cloud

Formazione

Technical degree or equivalent

Strumenti

Rapid7 InsightIDR

Splunk

Microsoft Sentinel

Descrizione del lavoro

At Kognitiv Inc., we’re redefining what it means to be a Workday partner. As one of the fastest-growing companies in the ecosystem, we bring deep expertise, innovative thinking, and a people-first mindset to everything we do. We’re not just building better Workday solutions—we’re building a company where talented people thrive.

Ready to do your best work? Join us.

About The Role

Kognitiv is hiring a Cybersecurity SOC Analyst to investigate security alerts, improve detection rules and monitor how sensitive data moves across our environment. You'll support Kognitiv globally, adding European time-zone coverage alongside our North American security coverage.

This is a hands‑on security operations role. Your focus will be working with our security information and event management (SIEM) platform and data loss prevention (DLP) tools, rather than leading audits, managing identity and access, or owning security strategy. You'll report to Ousmane Ndiaye and work closely with him on day-to-day security operations.

What You'll Do

• Monitor, triage and investigate security alerts in Rapid7 InsightIDR, bringing together logs from firewalls, endpoints and other devices, and help mitigate verified security incidents.
• Write and tune detection rules that correlate events across sources, including endpoint detection and response signals from SentinelOne. Identify opportunities to automate triage and reduce manual effort.
• Review DLP events in Cyberhaven to identify potentially inappropriate movement of client or company data, including transfers to personal email or AI platforms.
• Follow up with colleagues and their managers to understand flagged activity and investigate potential security concerns.
• Apply your understanding of the technology being protected to distinguish suspicious behavior from expected activity.
• Track emerging threats, malware and cloud vulnerabilities, and contribute findings to incident response playbooks and detection improvements.

What You'll Bring

• Hands-on SOC analyst experience investigating alerts and working with SIEM platforms. We're targeting experience typically gained over 2-4 years; this is not an entry‑level role or an upper limit on experience.
• Practical experience with Rapid7, Splunk, Microsoft Sentinel or another SIEM. You should be able to explain how you've used the platform in real investigations; prior Rapid7 experience is not required.
• Experience working with DLP tools and investigating potential data loss or inappropriate data transfers.
• Querying, scripting or programming skills you can apply to security analysis and detection rules. Experience with LEQL, KQL, SPL or Python is relevant; you don't need to know all of them.
• A broad understanding of IT systems, network protocols and cloud architectures, gained through a relevant technical degree or equivalent industry experience.
• Practical experience with endpoint detection and response (EDR) tools alongside your SIEM and DLP work.
• A methodical approach to active investigations and careful attention to log data, network traffic and subtle indicators of compromise.
• Curiosity and a willingness to keep learning as threats, vulnerabilities and attacker tactics evolve.

Nice to Have

• Experience with Rapid7, Cyberhaven or SentinelOne.
• Familiarity with MITRE ATT&CK or CIS Controls to support your analysis.
• Security+, CySA+, a relevant Splunk security certification or Rapid7 InsightIDR Certified Specialist. Certifications are helpful, not mandatory.
• SIEM engineering or log-platform configuration experience.

Location and Working Hours

This role is intended to be based in Europe and supports Kognitiv globally. You'll generally work regular hours in your local time zone, with occasional later meetings to collaborate across regions. Visa sponsorship is not available.

Kognitiv is an Equal Opportunity Employer: All applicants will receive consideration for employment without regard to age, ancestry, color, family or medical care leave, gender identity or expression, genetic information, marital status, medical condition, national origin, physical or mental disability, political affiliation, protected veteran status, race, religion, sex (including pregnancy), sexual orientation, or any other characteristic protected by applicable laws, regulations and ordinances. Kognitiv will consider for employment qualified applicants with arrest or conviction records in a manner consistent with the requirements of the law, including any applicable fair chance law.

Work Authorization: Applicants for employment in the country in which they are applying (Employing Country) must have work authorization that does not now or in the future require sponsorship of a visa for employment authorization in the Employing Country and with Kognitiv.

Estimated Application Deadline

This job postings' application deadline is an estimate, but ultimately the fill date is flexible and the job will remain open until filled. Any updates on deadlines will be communicated through this job posting.

2026-12-06

Pay Transparency Statement

Kognitiv is committed to a transparent and equitable compensation structure, which is determined by a variety of factors including skill set, experience, education, market data, and internal equity. In instances where a role is open to multiple experience levels, the posted salary range may be broad; a more granular, level-specific range will be defined and discussed during the interview process. Candidates invited to a recruiter screen can expect a candid discussion of our compensation philosophy, the specific salary range for this position, and the variable pay opportunities that may be available for this role. For details on our comprehensive benefits package please visit our careers website