SOC Analyst (WAAP)

Webhosting; Kraków; Hybrid; PLN 60,000 - 90,000; Full time

Job summary

Gcore is seeking a SOC Analyst to monitor WAAP and DDoS activity across customer accounts, review traffic patterns, and distinguish malicious events from legitimate traffic.

You will triage alerts, prepare weekly threat summaries in clear customer-facing English, escalate incidents with the proper context, and help maintain runbooks and onboarding playbooks for consistency and speed, while collaborating with Threat Researchers on enterprise-scale security operations.

Responsibilities

• Monitor WAAP and DDoS activity across customer accounts – dashboards, alerts, and traffic patterns; recognize when something needs attention.
• Triage false positives: review traffic flagged by security policies, confirm or dismiss, and reduce noise for customers.
• Prepare reports: weekly threat summaries per customer and post-incident DDoS reports, in clear customer-facing English.
• Alert and elevate: signal engineering or Support when an attack impacts a customer and follow the escalation runbook.
• Support customer onboarding: apply standard security configuration based on the customer’s profile, following playbooks.

Job description

Not specified Full-time Not specified Operations

Job Description

Gcore WAAPprotects customer web applications and APIs against DDoS, bots, and application-layer attacks at CDN edge scale. We are building out a proactive, managed-support offering for enterprise customers, and we need a SOC Analyst to run the day-to-day security operations: watch traffic and alerts, triage false positives, prepare customer-facing threat reports, and elevate real impact to the right team. You will work alongside our Threat Researchers, taking the operational load off them so they can focus on deep analysis. You do not need to be a threat-hunting expert.

You need to be reliable, observant, comfortable in logs and dashboards, and able to tell an attack from legitimate traffic – and know when to elevate.

What You Will Do

• Monitor WAAP and DDoS activity across customer accounts – dashboards, alerts, and traffic patterns – and recognize when something needs attention.
• Triage false positives: review traffic flagged by security policies, confirm or dismiss, and keep noise down for customers (this is a large, daily part of the job).
• Prepare reports: weekly threat summaries per customer and post-incident DDoS reports, in clear customer-facing English.
• Alert and elevate: when an attack is impacting a customer, signal the engineering team or Support with the right context – e.g. a customer needs to be tagged or a policy adjusted – and follow the escalation runbook.
• Support customer onboarding: apply standard security configuration based on the customer’s profile (resource type, traffic volume, legitimate-traffic exclusions) following playbooks.
• Follow the reaction-time SLA – our commitment to customers is speed of reaction and clear post-incident reporting, not a prevention guarantee.
• Contribute to and maintain runbooks so responses are consistent and repeatable.

This position is available only under an employment (labor) agreement.

The world’s digital experiences run on something invisible: the infrastructure and software that keep them fast, reliable, and secure. At Gcore,you’ll help design and deliver that foundation for an AI-driven world.

We’re a global provider of infrastructure and software solutions forAI, cloud, network, and security,powering everything from real-time communication and streaming to enterprise AI and secure web applications. With210+ edge locations, 50+ cloud regions, and thousands of GPUs,your work here can reach users and businesses across the globe.

You’ll collaborate with leading technology partners such asIntel, NVIDIA, Dell, and Equinix,and work on platforms that power digital products used around the world. Our vision is simple: to connect the world to AI, anywhere, anytime.

Want to work on technology that goes beyond a single product or industry?Join a global team of550+ professionalsbuilding infrastructure and software that supports the entire digital ecosystem.