SOC Analyst L1/L2 (SIEM / EDR / Threat Hunting)

eXalt Fi; Porto; On-site; EUR 30,000 - 42,000; Full time

Job summary

eXalt Fi in Porto is seeking a SOC Analyst to monitor, triage, and respond to security alerts as part of a permanent on-site team. You will tune detections, hunt for threats, and document incidents to support fast, clear escalation and playbook improvements.

Entry-level professionals with up to two years in a SOC or security monitoring role are welcome. English is required; French or Portuguese is a plus. The role requires Porto-based availability for 24/7 shifts.

Qualifications

• Experience in a SOC or security monitoring role (0–2 years).
• Hands-on with SIEMs such as Splunk, QRadar, Microsoft Sentinel or Elastic.
• EDR experience with CrowdStrike, Defender or SentinelOne.
• Fundamentals in incident response, threat intelligence, MITRE ATT&CK.
• English required; French or Portuguese is a plus.

Responsibilities

• Monitor and triage alerts from SIEM, EDR, IDS/IPS and firewalls.
• Tune detection rules and report noisy or missing alerts.
• Proactively hunt for suspicious activity before it becomes an incident.
• Investigate first-level alerts and escalate to L2 with clear documentation.
• Document incidents and enrich SOC playbooks for continuous improvement.
• Based in Porto or willing to relocate; available for 24/7 shifts.

Skills

Monitoring

Incident handling

Threat hunting

Detection

Documentation

Tools

Splunk

QRadar

Microsoft Sentinel

Elastic

CrowdStrike

Microsoft Defender

SentinelOne

Job description

Permanent contract | On-site, 24/7 shifts | Porto, Portugal

Our client, a leading pan-European stock exchange group, is strengthening its Security Operations Center in Porto. You will help protect critical market infrastructure, around the clock, alongside IT and cybersecurity teams.

On-site role with 24/7 rotating shifts, nights and weekends included.

• Monitoring: watch and triage alerts from SIEM, EDR, IDS/IPS and firewalls.
• Detection: help tune detection rules and report noisy or missing alerts.
• Threat hunting: proactively search for suspicious activity before it becomes an incident.
• Incident handling: investigate first-level alerts and elevate to L2 with clear documentation.
• Continuous improvement: document incidents and enrich SOC playbooks.
• Experience: 0 to 2 years in a SOC or a security monitoring role (internships and apprenticeships count).
• SIEM: hands-on with Splunk, QRadar, Microsoft Sentinel, Elastic or similar.
• EDR: CrowdStrike, Microsoft Defender, SentinelOne or similar.
• Fundamentals: incident response, threat intelligence, MITRE ATT&CK.
• Languages: professional English; French or Portuguese is a plus.
• Location: based in Porto or ready to relocate, available for 24/7 shifts.