SOC Analyst (Lisbon - Hybrid)

Claranet Portugal; Lisboa; Presencial; EUR 42 000 - 54 000; Tempo integral

Resumo da oferta

Claranet Portugal is seeking a SOC Analyst to join our Talent team in Lisbon. You will support the SOC, investigate security alerts, and coordinate with IT and cybersecurity teams to resolve incidents.

The role requires at least 3 years in security operations, strong English, and hands-on SIEM/tool experience. You will work with leading security platforms and contribute to detection rule enhancements.

Qualificações

• Minimum of 3 years of experience in Security Operations (SOC) or security monitoring.
• Advanced English is mandatory.
• Hands-on experience with SIEM platforms and security tools.

Responsabilidades

• Support the internal SOC team in triage, investigation, and resolution of security alerts.
• Monitor security events and alerts across SIEM, EDR, IDS/IPS, firewalls, and other tools.
• Analyze and investigate alerts to identify potential security incidents or suspicious activity.
• Perform triage and classification of incidents according to defined procedures.
• Execute initial response and containment actions when applicable.
• Escalate incidents to advanced security teams as needed.
• Perform log analysis and event correlation using SIEM platforms.
• Document incidents, investigations, and actions in line with SOC processes.
• Contribute to improvements of detection rules and use cases.
• Support fine-tuning of security tools to reduce false positives.
• Collaborate with IT and cybersecurity teams on incident investigation and resolution.

Conhecimentos

Advanced English

SOC experience

Log analysis

Network protocols knowledge

MITRE ATT&CK

NIST frameworks

Formação académica

Cybersecurity certifications (e.g., CompTIA Security+, CySA+, GCIH, SC-200)

Ferramentas

Splunk

QRadar

Microsoft Sentinel

EDR/XDR

IDS/IPS

Firewalls

Endpoint protection

Descrição da oferta de emprego

We're fast learners, hard workers, natural collaborators... and we Make Modern Happen!

Our ambition is to unlock the potential of our digital world so that organisations everywhere can innovate and thrive securely.

We aim to achieve this goal by bringing together the world’s most talented people and the most powerful technologies, combining them to address our customers' challenges and to build something stronger together.

Right now, we are looking for a SOC Analyst to integrate our Talent team.

Your responsibilities include:

• Support the internal SOC team in the triage, investigation, and resolution of security alerts;
• Monitor security events and alerts across multiple tools (SIEM, EDR, IDS/IPS, firewalls, etc.);
• Analyze and investigate alerts to identify potential security incidents or suspicious activity;
• Perform triage and classification of incidents according to defined procedures;
• Execute initial response and containment actions when applicable;
• Escalate incidents to advanced security teams or relevant technical teams as needed;
• Perform log analysis and event correlation using SIEM platforms;
• Document incidents, investigations, and actions in line with SOC processes;
• Contribute to the continuous improvement of detection rules and use cases;
• Support the fine-tuning of security tools to reduce false positives;
• Collaborate with IT and cybersecurity teams on incident investigation and resolution.

You must have:

• Minimum of 3 years of experience in Security Operations (SOC) or security monitoring;
• Advanced English (mandatory);
• Hands-on experience with SIEM platforms (e.g., Splunk, QRadar, Microsoft Sentinel);
• Experience analysing security logs and network events;
• Solid understanding of network protocols, operating systems, and IT architecture;
• Familiarity with security tools such as EDR/XDR, IDS/IPS, firewalls, and endpoint protection;
• Knowledge of cybersecurity frameworks (e.g., MITRE ATT&CK, NIST);
• Experience with security incident management processes.

We value:

• Experience in threat hunting or advanced incident analysis;
• Knowledge of security automation and orchestration tools (SOAR);
• Experience working with cloud environments (Azure, AWS, or GCP);
• Relevant cybersecurity certifications (e.g., CompTIA Security+, CySA+, GCIH, SC-200).