SOC Analyst: WAAP & DDoS Security Ops

Webhosting; Kraków; Hybrid; PLN 60,000 - 90,000; Full time

Job summary

Gcore is seeking a SOC Analyst to monitor WAAP and DDoS activity across customer accounts, review traffic patterns, and distinguish malicious events from legitimate traffic.

You will triage alerts, prepare weekly threat summaries in clear customer-facing English, escalate incidents with the proper context, and help maintain runbooks and onboarding playbooks for consistency and speed, while collaborating with Threat Researchers on enterprise-scale security operations.

Responsibilities

• Monitor WAAP and DDoS activity across customer accounts – dashboards, alerts, and traffic patterns; recognize when something needs attention.
• Triage false positives: review traffic flagged by security policies, confirm or dismiss, and reduce noise for customers.
• Prepare reports: weekly threat summaries per customer and post-incident DDoS reports, in clear customer-facing English.
• Alert and elevate: signal engineering or Support when an attack impacts a customer and follow the escalation runbook.
• Support customer onboarding: apply standard security configuration based on the customer’s profile, following playbooks.

Job description

Gcore is seeking a SOC Analyst to monitor WAAP and DDoS activity across customer accounts, review traffic patterns, and distinguish malicious events from legitimate traffic.

You will triage alerts, prepare weekly threat summaries in clear customer-facing English, escalate incidents with the proper context, and help maintain runbooks and onboarding playbooks for consistency and speed, while collaborating with Threat Researchers on enterprise-scale security operations.