Information Security Analyst SOC Tier 1

Ryanair Group Holdings; Wrocław; On-site; PLN 110,000 - 180,000; Full time

Benefits offered by this job

Staff travel benefits

Multisport card

Job summary

Ryanair Labs is hiring an Information Security Analyst SOC Tier 1 in Wrocław to join Europe’s Largest Airline Group. You will analyze, triage and respond to security events on the SIEM, monitor alarms and collaborate on improving security posture.

This role requires 12-hour shifts on a 24/7 team and offers a permanent contract after a trial period. Responsibilities include writing and tuning SIEM rules, log analysis, threat research, and supporting compliance and reporting.

Qualifications

• Experience analysing and interpreting SOC data with incident handling.
• Familiarity with IT security monitoring, cyber threat analysis and vulnerability analysis.
• Knowledge of multiple OS and system administration (Windows, Linux, Mac, VM platforms).
• Experience with security tools: vulnerability scanners, IDS/IPS, SIEM, etc.

Responsibilities

• Analyze, triage and respond to security events on the SIEM platform.
• Monitor alarms, assess event data and determine incident severity and escalation.
• Tune SIEM rules to reduce false positives and improve alerts.
• Analyze logs from various sources and support threat intelligence efforts.
• Participate in vulnerability assessments and remediation planning.
• Document security operations procedures and incident case data.

Skills

SOC analysis

SIEM monitoring

Networking basics

TCP/IP knowledge

Firewall configuration

Threat analysis

Threat hunting

ELK stack

Education

Information/Cybersecurity degree

Tools

Vulnerability scanners

IDS/IPS

SIEM

tcpdump

Wireshark

Job description

Ryanair Labs are currently recruiting for an Information Security Analyst SOC Tier 1 to join Europe’s Largest Airline Group!

This is a very exciting time to join Ryanair as we look to expand our operation to 800 aircraft and 300 million guests within the next 10 years.

Ryanair Labs is the technology brand of Ryanair. Labs is a state of-the-art digital & IT innovation hub creating Europe's Leading Travel Experience for our customers.

This role is located in Wrocław and requires ability to cover 12hr shifts on the 24/7 team.

Job Description

The Role:

• Analyze, triage and respond to security events, alarms and escalations as required, acting as the line security event analyst monitoring the Security Information and Event Management (SIEM) system.
• Monitor the alarm dashboard, providing an initial analysis of event data and network traffic, making security event determinations on alarm severity, escalation and response routing.
• Recommend changes to enhance systems security and prevent unauthorized access to IT Lab and Client systems.
• Conduct research and assessments of security events, providing analysis of firewall, IDS, anti-virus and other network sensor produced events, to feed into SOC reporting activities and improvements.
• Monitor threat and vulnerability news services for any relevant information that may impact installed infrastructure.
• Analyse reports to understand threat campaign(s) techniques, lateral movements and extract indicators of compromise.
• Write, modify, and fine tune, SIEM rulesets for improved alerting and reduction of false positives.
• Analyze log data from various sources.
• Participate in compliance/vulnerability assessment scanning and develop mitigation and remediation plans from the assessment findings.
• Document information security operations policies, processes, and procedures. Create and update security event investigation notes on open incidents, and maintain case data in the incident response management platform.
• Provide input, as requested, for Security, Risk, Compliance and Service reporting.

Qualifications

Requirements:

• Understanding of performing analysis and interpretation of information from SOC systems: incident identification / analysis, escalation procedures and reduction of false-positives
• Related experience and training in the field of IT security monitoring and analysis, cyber threat analysis, and vulnerability analysis
• Knowledge of multiple operating systems and applicable system administration skills (Windows, Linux, Mac, VM platforms)
• Experience using Security tools, such as Vulnerability scanners, IDS/IPS, SIEM, etc.
• Detailed understanding of TCP/IP and a good background in network troubleshooting and technologies; Firewall configuration, monitoring, network packet capture (tcpdump / Wireshark), etc.
• Understanding of threat analysis, threat hunting, and intelligence feeds
• Excellent knowledge of commonly used Internet protocols such as SMTP, HTTP, and DNS
• Knowledge of adversarial simulation frameworks

Nice to have:

• A University degree level education (or equivalent professional certifications) in Information / Cybersecurity, Forensics or Computer Science
• Host-based forensics
• Experience in IT security within multi-supplier and Cloud IT environments
• Experience in ELK stack
• Malware analysis and sandboxing

Additional Information

Benefits & form of employment

Contract of employment (permanent contract after trial period)

• Staff travel benefits from day one
• Multisport card

Other benefits

• Possibility of taking part in trainings and certifications
• Great chance to meet your colleagues in other offices
• Annual events (i.e. St. Patrick’s Day )
• Regular social meetings
• Paid referral system
• New office building surrounded by great dinettes right in the city centre