SOC Analyst

Planet; Warszawa; Hybrid; PLN 140,000 - 190,000; Full time

Job summary

Planet is seeking a SOC Analyst to monitor, investigate, and respond to security alerts across our technology estate. You will triage alerts, analyze events, escalate risks, and help improve detection and response capabilities to protect operations and regulatory compliance.

Hands-on experience with Microsoft Sentinel, Defender XDR, SentinelOne, and vulnerability management is advantageous. The role supports ongoing security operations within a hybrid work model, and familiarity with payments

Qualifications

• Experience triaging and investigating security alerts in a SOC.
• Hands-on with SIEM, EDR/XDR and threat monitoring platforms.
• Understanding of PCI DSS, regulatory expectations, or controlled environments.

Responsibilities

• Monitor security alerts and events across security tooling and cloud services.
• Triage and investigate alerts to determine severity and response actions.
• Escalate incidents in line with SOC procedures and playbooks.
• Analyse logs, endpoint telemetry, identity events, and cloud activity for suspicious activity.
• Support containment, evidence gathering, and remediation during incidents.
• Contribute to improving detection logic and SOC processes.

Skills

SOC experience

Threat monitoring

Log analysis

Incident response

Security incident triage

Tools

SIEM

EDR

XDR

KQL

Job description

About Planet

Planet is a global provider of integrated technology and payments solutions for retail and hospitality customers.

We create great experiences for the millions of people who use our payments, software, and tax-free solutions every minute of every day.

Planet empowers its customers to deliver great customer experiences by combining payments and software in ways that drive greater loyalty, increase revenue and save time.

Founded over 35 years ago and with our headquarters in London, today we have more than 2,500 employees located across six continents serving our customers in more than 120 markets.

Role overview:

The SOC Analyst is responsible for monitoring, investigating, and responding to security alerts across the organisation’s technology estate. The role supports the day-to-day operation of the Security Operations Centre by triaging alerts, analysing security events, escalating confirmed risks, and helping to improve detection and response capability. The successful candidate will play an important role in protecting the organisation from cyber threats while supporting operational resilience, regulatory requirements, and PCI DSS compliance obligations.

The role requires hands-on experience with security monitoring tools, incident triage, log analysis, endpoint security, cloud security alerts, and structured incident response processes. Experience with Microsoft Sentinel, Microsoft Defender XDR, SentinelOne, vulnerability management processes, and working within regulated or payments environments would be advantageous.

What you will do

Security Monitoring & Incident Response

• Monitor security alerts and events across Microsoft Sentinel, Microsoft Defender XDR, endpoint security platforms, cloud services, and other security tooling.
• Triage and investigate alerts to determine severity, business impact, and appropriate response actions.
• Escalate confirmed or suspected incidents in line with SOC procedures and incident response playbooks.
• Analyse logs, endpoint telemetry, identity events, and cloud activity to identify suspicious behaviour and potential compromise.
• Support containment, evidence gathering, and remediation activities during security incidents.
• Contribute to the continuous improvement of detection logic, alert quality, and SOC operational processes.

Security Tooling & Operational Support

• Use Microsoft Sentinel, Microsoft Defender XDR, SentinelOne, vulnerability management platforms, and other security tools to support daily SOC operations.
• Assist with alert tuning by identifying false positives, recurring noise, and opportunities to improve detection accuracy.
• Maintain clear investigation notes, incident records, and operational documentation.
• Support vulnerability monitoring, validation, and escalation where findings present operational or compliance risk.

Governance, Compliance & Reporting

• Support SOC activities that help maintain compliance with PCI DSS and other regulatory requirements.
• Produce clear, accurate, and timely updates on incidents, investigations, and operational security issues.
• Maintain audit-ready records relating to alerts, investigations, incidents, and response actions.
• Support internal and external audit activities by providing evidence and operational context where required.

Key Deliverables

• Security alerts triaged, investigated, and escalated within agreed operational procedures.
• Incident records and investigation notes maintained to a consistent and audit-ready standard.
• Confirmed threats escalated promptly with clear evidence, impact assessment, and recommended next steps.
• False positives, recurring alert noise, and detection gaps identified and fed into continuous improvement activity.
• Security monitoring, vulnerability, and incident response activities supported in line with SOC priorities.
• Improved visibility, response consistency, and operational discipline across SOC activities.

Who you are

• Experience triaging and investigating security alerts in a SOC or security operations environment.
• Good understanding of common cyber threats, attack techniques, endpoint activity, identity events, and network indicators.
• Hands‑on experience using SIEM, EDR, XDR, or similar security monitoring platforms.
• Ability to analyse logs, correlate events, and document findings clearly.
• Understanding of incident response processes, escalation routes, and evidence handling.
• Awareness of PCI DSS, regulatory expectations, or working in a controlled operational environment.

Nice-to-Have

• Experience with Microsoft Sentinel, Microsoft Defender XDR, SentinelOne, Rapid7, or similar platforms.
• Familiarity with KQL or other query languages used for security investigation and threat hunting.
• Experience supporting vulnerability management, phishing investigations, malware analysis, or cloud security alert triage.
• Relevant security certifications such as SC-200, Security+, CySA+, or equivalent practical experience.

Why Planet:

Planet is an equal opportunity employer where diversity is valued, and all employment is decided based on qualifications, merit, and business need.

Come and grow your career in the most exciting, fast paced technology market, with a business that delivers feel-good connected commerce.

At Planet, we embrace a hybrid work model, with three days a week in the office.

Reasonable accommodations may be made in order to allow for an individual to perform the essential functions of this role successfully.