SOC Analyst L1/L2 - Frontline Security Investigator

UnderDefense LLC; Warszawa; On-site; PLN 120,000 - 180,000; Full time

Job summary

UnderDefense is seeking a sharp SOC Analyst (L1/L2) based in Warsaw to join a dedicated security operations team embedded with a Fortune 500 client portfolio. You will investigate alerts, validate context, and escalate incidents with full context and clear documentation.

Ideal candidates have 2+ years of hands-on SOC experience, strong SIEM/EDR/SOAR skills, and proficiency in MITRE ATT&CK. This 24/7 shift-based, office-based role in Warsaw requires independent work and excellent English

Qualifications

• 2+ years hands-on SOC experience (L1/L2).
• Experience with SIEM (Splunk preferred), EDR (CrowdStrike preferred), SOAR.
• Ability to read raw events and correlate across platforms.
• Working knowledge of MITRE ATT&CK framework and its application.
• Clear written English communications (B2+).

Responsibilities

• Own end-to-end investigation of alerts — from triage to closure or escalation.
• Investigate at Tier 1–2 level using SIEM, SOAR, EDR, identity and SaaS telemetry.
• Validate alert context, enrich indicators, build timelines, and classify activity.
• Document investigations with evidence, reasoning, impact, and MITRE mapping.
• Escalate confirmed or high-risk incidents with context for rapid response.
• Maintain disciplined shift handoffs and clear action trackers.
• Handle security requests (suspicious emails, anomalous accounts) with rigor.
• Identify false positives and provide tuning feedback with log evidence.
• Operate within client toolstack, data boundaries, and escalation procedures.

Skills

SOC experience

SIEM

EDR

SOAR

MITRE ATT&CK

English communication

Shift-based

Independent worker

Tools

Splunk

Coralogix

CrowdStrike Falcon

Blink Mate

Okta

Job description

UnderDefense is seeking a sharp SOC Analyst (L1/L2) based in Warsaw to join a dedicated security operations team embedded with a Fortune 500 client portfolio. You will investigate alerts, validate context, and escalate incidents with full context and clear documentation.

Ideal candidates have 2+ years of hands-on SOC experience, strong SIEM/EDR/SOAR skills, and proficiency in MITRE ATT&CK. This 24/7 shift-based, office-based role in Warsaw requires independent work and excellent English