Frontline SOC Analyst (L1/L2) — Warsaw, Shift-Based

UnderDefense Inc.; Warszawa; Hybrid; PLN 120,000 - 180,000; Full time

Job summary

UnderDefense Inc. in Warsaw is seeking a sharp SOC Analyst (L1/L2) to join our security operations team. This hands-on role sits in a fast-growing global SaaS company with a 24/7 SOC and direct exposure to Fortune 500 clients. You will investigate alerts, triage, and escalate threats with full context.

We expect 2+ years of SOC experience, proficiency with SIEM (Splunk), EDR (CrowdStrike), and SOAR, plus strong written English. Relocation support is available for Warsaw-based candidates.

Qualifications

• 2+ years of hands-on SOC experience (L1/L2).
• Solid experience with SIEM (Splunk preferred).
• Experience with EDR (CrowdStrike preferred) and SOAR tools.
• Ability to read raw events and correlate across platforms.
• Working knowledge of MITRE ATT&CK framework and its application.
• Clear, structured written English communication.

Responsibilities

• Own end-to-end investigation of assigned alerts from triage to closure or escalation.
• Investigate at Tier 1–2 level using SIEM, SOAR, EDR, identity and SaaS telemetry.
• Validate alert context, enrich indicators, build timelines, judge activity as benign, suspicious, or malicious.
• Document investigations with evidence, reasoning, impact, and MITRE mapping.
• Escalate high-risk incidents through the T3 process with context for rapid response.
• Maintain shift handoffs with clear open investigations and actions.
• Handle security requests (suspicious emails, anomalous behavior, lost devices) with rigor.
• Identify false positives and gaps; provide tuning feedback with logs.
• Operate within client toolstack, data boundaries, and escalation procedures.

Skills

SOC experience (L1/L2)

SIEM

EDR

SOAR

MITRE ATT&CK

English communication

Shift work capability

Tools

Splunk

CrowdStrike Falcon

Blink Mate

Job description

UnderDefense Inc. in Warsaw is seeking a sharp SOC Analyst (L1/L2) to join our security operations team. This hands-on role sits in a fast-growing global SaaS company with a 24/7 SOC and direct exposure to Fortune 500 clients. You will investigate alerts, triage, and escalate threats with full context.

We expect 2+ years of SOC experience, proficiency with SIEM (Splunk), EDR (CrowdStrike), and SOAR, plus strong written English. Relocation support is available for Warsaw-based candidates.