Cybersecurity SOC Analyst

EOR - Europe; Polska; Ibrido; PLN 140.000 - 210.000; Tempo pieno

Descrizione del lavoro

Kognitiv is seeking a Cybersecurity SOC Analyst to investigate security alerts, improve detection rules, and monitor data movement across our environment. You will support global operations with European time-zone coverage, focusing on SIEM (Rapid7 InsightIDR) and DLP tooling in a hands-on role.

You'll work with our team to tune detections, automate triage, and stay ahead of threats across endpoints and cloud services.

Competenze

• 2–4 years hands-on SOC analyst experience with SIEM platforms.
• Practical experience with Rapid7, Splunk or Microsoft Sentinel in real investigations.
• Experience with DLP tools and investigating data loss or transfers.
• Scripting or programming for security analysis (LEQL, KQL, SPL or Python).
• Understanding IT systems, networks and cloud architectures.
• EDR experience alongside SIEM and DLP work.
• Methodical approach to investigations and log data analysis.

Mansioni

• Monitor, triage and investigate security alerts across SIEM platforms.
• Write and tune detection rules correlating events from multiple sources (including EDR signals).
• Identify opportunities to automate triage and reduce manual effort.
• Review DLP events to detect inappropriate data transfers.
• Collaborate with colleagues to understand flagged activity and investigate concerns.
• Apply knowledge of protected tech to distinguish suspicious from normal activity.
• Track threats, malware and cloud vulnerabilities; contribute to incident response playbooks.

Conoscenze

SOC analysis

SIEM usage

Threat detection

EDR tools

Scripting

Formazione

Relevant technical degree

Strumenti

Rapid7 InsightIDR

Splunk

Microsoft Sentinel

SentinelOne

Cyberhaven

Descrizione del lavoro

About the Role

Kognitiv is hiring a Cybersecurity SOC Analyst to investigate security alerts, improve detection rules and monitor how sensitive data moves across our environment. You'll support Kognitiv globally, adding European time-zone coverage alongside our North American security coverage. This is a hands‑on security operations role. Your focus will be working with our security information and event management (SIEM) platform and data loss prevention (DLP) tools, rather than leading audits, managing identity and access, or owning security strategy. You'll report to Ousmane Ndiaye and work closely with him on day‑to‑day security operations.

What You'll Do

• Monitor, triage and investigate security alerts in Rapid7 InsightIDR, bringing together logs from firewalls, endpoints and other devices, and help mitigate verified security incidents.
• Write and tune detection rules that correlate events across sources, including endpoint detection and response signals from SentinelOne.
• Identify opportunities to automate triage and reduce manual effort.
• Review DLP events in Cyberhaven to identify potentially inappropriate movement of client or company data, including transfers to personal email or AI platforms.
• Follow up with colleagues and their managers to understand flagged activity and investigate potential security concerns.
• Apply your understanding of the technology being protected to distinguish suspicious behavior from expected activity.
• Track emerging threats, malware and cloud vulnerabilities, and contribute findings to incident response playbooks and detection improvements.

What You'll Bring

• Hands‑on SOC analyst experience investigating alerts and working with SIEM platforms. We're targeting experience typically gained over 2-4 years; this is not an entry‑level role or an upper limit on experience.
• Practical experience with Rapid7, Splunk, Microsoft Sentinel or another SIEM. You should be able to explain how you've used the platform in real investigations; prior Rapid7 experience is not required.
• Experience working with DLP tools and investigating potential data loss or inappropriate data transfers.
• Querying, scripting or programming skills you can apply to security analysis and detection rules. Experience with LEQL, KQL, SPL or Python is relevant; you don't need to know all of them.
• A broad understanding of IT systems, network protocols and cloud architectures, gained through a relevant technical degree or equivalent industry experience.
• Practical experience with endpoint detection and response (EDR) tools alongside your SIEM and DLP work.
• A methodical approach to active investigations and careful attention to log data, network traffic and subtle indicators of compromise.
• Curiosity and a willingness to keep learning as threats, vulnerabilities and attacker tactics evolve.

Nice to Have

• Experience with Rapid7, Cyberhaven or SentinelOne.
• Familiarity with MITRE ATT&CK or CIS Controls to support your analysis.
• Security+, CySA+, a relevant Splunk security certification or Rapid7 InsightIDR Certified Specialist. Certifications are helpful, not mandatory.
• SIEM engineering or log‑platform configuration experience.

Location and Working Hours

This role is intended to be based in Europe and supports Kognitiv globally. You'll generally work regular hours in your local time zone, with occasional later meetings to collaborate across regions. Visa sponsorship is not available.

Kognitiv is an Equal Opportunity Employer: All applicants will receive consideration for employment without regard to age, ancestry, color, family or medical care leave, gender identity or expression, genetic information, marital status, medical condition, national origin, physical or mental disability, political affiliation, protected veteran status, race, religion, sex (including pregnancy), sexual orientation, or any other characteristic protected by applicable laws, regulations and ordinances.

Kognitiv will consider for employment qualified applicants with arrest or conviction records in a manner consistent with the requirements of the law, including any applicable fair chance law.

Work Authorization: Applicants for employment in the country in which they are applying (Employing Country) must have work authorization that does not now or in the future require sponsorship of a visa for employment authorization in the Employing Country and with Kognitiv.

Estimated Application Deadline This job postings' application deadline is an estimate, but ultimately the fill date is flexible and the job will remain open until filled. Any updates on deadlines will be communicated through this job posting. 2026-12-06 #LI-JP1

The founders and consultants of Kognitiv live and breathe Workday®. We understand that going live with your new system is just the first step in a long partnership with Workday® and its ecosystem. Implementations are fast and furious, with work like reports, dashboards, and knowledge transfer often postponed until after a go‑live. In some cases, your implementation partner has already moved on to its next project. This is why Kognitiv exists: to bridge the gap for those clients wanting to better maintain and enhance their system post a go‑live.