SOC Analyst

Planet Paymet; Warszawa; Hybrid; PLN 100,000 - 180,000; Full time

Benefits offered by this job

Hybrid work model

Job summary

Planet is a global provider of integrated technology and payments solutions for retail and hospitality customers, delivering secure experiences across our payments, software, and tax-free platforms.

The SOC Analyst will monitor, investigate, and respond to security alerts across the organisation’s technology estate, triaging incidents and helping to improve detection and response capabilities in a hybrid work model with three days in the office.

Qualifications

• Experience triaging and investigating security alerts in a SOC.
• Hands-on with SIEM, EDR, XDR platforms.
• Familiarity with PCI DSS and regulatory requirements.

Responsibilities

• Monitor security alerts across SIEM, EDR, XDR, and cloud services.
• Triage alerts to assess severity and impact.
• Escalate incidents per SOC procedures and playbooks.
• Analyze logs, endpoint telemetry, and identity events.
• Support containment and remediation during incidents.
• Improve detection logic and alert quality.

Skills

Security monitoring

Incident triage

Log analysis

Threat hunting

Documentation

PCI DSS awareness

Education

SC-200

Security+

CySA+

Tools

SIEM

EDR

XDR

Microsoft Sentinel

Defender XDR

SentinelOne

Job description

About Planet Planet is a global provider of integrated technology and payments solutions for retail and hospitality customers. We create great experiences for the millions of people who use our payments, software, and tax-free solutions every minute of every day. Planet empowers its customers to deliver great customer experiences by combining payments and software in ways that drive greater loyalty, increase revenue an d save time. Founded over 35 years ago and with our headquarters in London, today we have more than 2,500 employees located across six continents serving our customers in more than 120 markets.

Role overview

The SOC Analyst is responsible for monitoring, investigating, and responding to security alerts across the organisation’s technology estate. The role supports the day-to-day operation of the Security Operations Centre by triaging alerts, analysing security events, escalating confirmed risks, and helping to improve detection and response capability. The successful candidate will play an important role in protecting the organisation from cyber threats while supporting operational resilience, regulatory requirements, and PCI DSS compliance obligations. The role requires hands-on experience with security monitoring tools, incident triage, log analysis, endpoint security, cloud security alerts, and structured incident response processes. Experience with Microsoft Sentinel, Microsoft Defender XDR, SentinelOne, vulnerability management processes, and working within regulated or payments environments would be advantageous.

What you will do

• Security Monitoring & Incident Response: Monitor security alerts and events across Microsoft Sentinel, Microsoft Defender XDR, endpoint security platforms, cloud services, and other security tooling.
• Triage and investigate alerts to determine severity, business impact, and appropriate response actions.
• Escalate confirmed or suspected incidents in line with SOC procedures and incident response playbooks.
• Analyse logs, endpoint telemetry, identity events, and cloud activity to identify suspicious behaviour and potential compromise.
• Support containment, evidence gathering, and remediation activities during security incidents.
• Contribute to the continuous improvement of detection logic, alert quality, and SOC operational processes.

Security Tooling & Operational Support

• Use Microsoft Sentinel, Microsoft Defender XDR, SentinelOne, vulnerability management platforms, and other security tools to support daily SOC operations.
• Assist with alert tuning by identifying false positives, recurring noise, and opportunities to improve detection accuracy.
• Maintain clear investigation notes, incident records, and operational documentation.
• Support vulnerability monitoring, validation, and escalation where findings present operational or compliance risk.

Governance, Compliance & Reporting

• Support SOC activities that help maintain compliance with PCI DSS and other regulatory requirements.
• Produce clear, accurate, and timely updates on incidents, investigations, and operational security issues.
• Maintain audit-ready records relating to alerts, investigations, incidents, and response actions.
• Support internal and external audit activities by providing evidence and operational context where required.

Key Deliverables

• Security alerts triaged, investigated, and escalated within agreed operational procedures.
• Incident records and investigation notes maintained to a consistent and audit-ready standard.
• Confirmed threats escalated promptly with clear evidence, impact assessment, and recommended next steps.
• False positives, recurring alert noise, and detection gaps identified and fed into continuous improvement activity.
• Security monitoring, vulnerability, and incident response activities supported in line with SOC priorities.
• Improved visibility, response consistency, and operational discipline across SOC activities.

Who you are

• Experience triaging and investigating security alerts in a SOC or security operations environment.
• Good understanding of common cyber threats, attack techniques, endpoint activity, identity events, and network indicators.
• Hands-on experience using SIEM, EDR, XDR, or similar security monitoring platforms.
• Ability to analyse logs, correlate events, and document findings clearly.
• Understanding of incident response processes, escalation routes, and evidence handling.
• Awareness of PCI DSS, regulatory expectations, or working in a controlled operational environment.

Nice-to-Have

• Experience with Microsoft Sentinel, Microsoft Defender XDR, SentinelOne, Rapid7, or similar platforms.
• Familiarity with KQL or other query languages used for security investigation and threat hunting.
• Experience supporting vulnerability management, phishing investigations, malware analysis, or cloud security alert triage.

Relevant security certifications

• Relevant security certifications such as SC-200, Security+, CySA+, or equivalent practical experience.

Why Planet

Planet is an equal opportunity employer where diversity is valued, and all employment is decided based on qualifications, merit, and business need.

Come and grow your career in the most exciting, fast paced technology market, with a business that delivers feel-good connected commerce.

At Planet, we embrace a hybrid work model, with three days a week in the office.

Reasonable accommodations may be made in order to allow for an individual to perform the essential functions of this role successfully.

Company Background

Planet provides integrated software, payment and technology solutions for its customers in the Hospitality and Retail sectors and worldwide via a network of global Financial Services Partners. Founded over 35 years ago, we have evolved our services, delivering an innovative digital commerce platform that puts customer experience first. With headquarters in London and around 3,000 expert employees located across six continents we serve customers in over 120 markets.