SOC Analyst (L1/L2)

UnderDefense Inc.; Warszawa; Hybrid; PLN 120,000 - 180,000; Full time

Job summary

UnderDefense Inc. in Warsaw is seeking a sharp SOC Analyst (L1/L2) to join our security operations team. This hands-on role sits in a fast-growing global SaaS company with a 24/7 SOC and direct exposure to Fortune 500 clients. You will investigate alerts, triage, and escalate threats with full context.

We expect 2+ years of SOC experience, proficiency with SIEM (Splunk), EDR (CrowdStrike), and SOAR, plus strong written English. Relocation support is available for Warsaw-based candidates.

Qualifications

• 2+ years of hands-on SOC experience (L1/L2).
• Solid experience with SIEM (Splunk preferred).
• Experience with EDR (CrowdStrike preferred) and SOAR tools.
• Ability to read raw events and correlate across platforms.
• Working knowledge of MITRE ATT&CK framework and its application.
• Clear, structured written English communication.

Responsibilities

• Own end-to-end investigation of assigned alerts from triage to closure or escalation.
• Investigate at Tier 1–2 level using SIEM, SOAR, EDR, identity and SaaS telemetry.
• Validate alert context, enrich indicators, build timelines, judge activity as benign, suspicious, or malicious.
• Document investigations with evidence, reasoning, impact, and MITRE mapping.
• Escalate high-risk incidents through the T3 process with context for rapid response.
• Maintain shift handoffs with clear open investigations and actions.
• Handle security requests (suspicious emails, anomalous behavior, lost devices) with rigor.
• Identify false positives and gaps; provide tuning feedback with logs.
• Operate within client toolstack, data boundaries, and escalation procedures.

Skills

SOC experience (L1/L2)

SIEM

EDR

SOAR

MITRE ATT&CK

English communication

Shift work capability

Tools

Splunk

CrowdStrike Falcon

Blink Mate

Job description

SOC Analyst (L1/L2)

UnderDefense is looking for a sharp, detail-oriented SOC Analyst to join a dedicated security operations team based in Warsaw. This is a hands-on, shift-based role embedded in a high-stakes environment – you will be the frontline of defense for a fast-growing global SaaS company with 20+ offices worldwide and Fortune 500 clients.

You will operate as part of a structured UnderDefense SOC team, working directly within the client’s security ecosystem. Alerts come to you pre-filtered by a SOAR automation layer — your job is to investigate what matters, make the call, and elevate confirmed threats to the client’s incident response team with full context and zero noise.

This role is ideal for someone who wants to go deep on real-world investigations across a modern, complex tool stack — identity, EDR, cloud, SaaS, and DevOps — all in one environment.

What you will do:

• Own end-to-end investigation of assigned alerts — from initial triage through closure or escalation.
• Investigate at Tier 1–2 level using SIEM (Splunk/Coralogix), SOAR (Blink Mate), EDR (CrowdStrike Falcon), identity, and SaaS telemetry.
• Validate alert context, enrich indicators, build timelines, and determine whether activity is benign, suspicious, or confirmed malicious.
• Document every investigation with clear evidence, reasoning, impact assessment, and MITRE ATT&CK mapping.
• Escalate confirmed or high-risk incidents through the agreed T3 process with sufficient technical context for rapid response.
• Maintain disciplined shift handoffs — open investigations, active risks, and pending actions must be clear to the next analyst.
• Handle employee-initiated security requests (suspicious emails, anomalous account behavior, lost/stolen devices) with the same rigor as platform-generated alerts.
• Identify false positives, automation gaps, and detection quality issues; provide structured tuning feedback with supporting log evidence.
• Operate strictly within the agreed client toolstack, data boundaries, and escalation procedures.

Data sources you will work across:

• Identity & SSO: Okta, Google Workspace, Microsoft (O365 + Azure AD), LastPass, Teleport, Apono
• EDR: CrowdStrike Falcon
• Email & Web: Perception Point, Talon, Prisma Access, Cloudflare, Palo Alto Panorama, Cisco Meraki
• SaaS & Collaboration: Salesforce, Slack, Box, DropBox, SharePoint, Google Workspace
• Cloud & DevOps: Wiz, GitHub, Astrix (NHI), Sweet Security, Workato, Koi
• Data & DLP: DoControl, Reco, Monte Carlo, Coralogix
• Threat Intel & Other: Mitiga, Sphera, internal TI feeds, correlation rules, UBA

What we are looking for:

• 2+ years of hands‑on SOC experience (L1/L2 level)
• Solid experience with SIEM (Splunk preferred), EDR (CrowdStrike preferred), SOAR tools
• Ability to read raw events and correlate across multiple platforms simultaneously
• Working knowledge of MITRE ATT&CK framework — not just the name, but the application
• Clear, structured written communication in English — your investigation notes are read by the client’s security team (B2+ required)
• Comfortable working in a shift-based schedule (24/7 coverage model); day shifts are office-based in Warsaw
• Able to work independently, maintain documentation discipline, and hand off cleanly
• Location: Warsaw, Poland (or willing to relocate — relocation support available)
• Background check required (criminal record clearance)

Nice to have:

• Certifications: CEH, GCIH, CompTIA Security+, or similar
• Experience with identity platforms (Okta, Azure AD) and cloud security tools (Wiz, Prisma)
• Familiarity with SOAR playbooks and automation logic

Salary:

We don’t believe in one-size-fits-all. Tell us what you’re worth and let’s talk. Compensation is competitive, tied to experience level, and based on Polish employment (B2B or UoP).

About this position

Location

Warsaw (Poland)

Employment type

Full time

Department

Services

Got Questions?
Let Us Help!

Mila Bokalo

Recruitment Specialist

[e-mail]