SOC & Threat Intelligence Analyst

MDS Group; Porto; On-site; EUR 35,000 - 52,000; Full time

Job summary

Solutions 360, a service and technology services company of MDS Group, is recruiting a Security & Threat Intelligence Analyst to join the SOC. The role covers monitoring, investigation, incident response, and day-to-day operation of the Cyberint Threat Intelligence platform across the organisation.

You will review alerts, triage incidents, and coordinate with Cyber Security and Technology teams. Strong generic cyber security knowledge, investigative skills and English fluency are essential.

Qualifications

• Previous experience within a SOC, Cyber Security Operations or similar security role.
• Practical experience investigating security alerts and incidents.
• Experience working with SIEM, XDR, EDR or similar security monitoring technologies.
• A good understanding of common cyber threats and attack techniques.
• A good understanding of identity, endpoint, email and network security concepts.
• Experience analysing security information from multiple sources to support an investigation.
• Good analytical and troubleshooting skills.
• Ability to clearly document technical investigations and findings.
• Ability to communicate effectively with both technical and non-technical stakeholders.
• Ability to take ownership of investigations and see them through to an appropriate conclusion.
• Ability to work effectively with other Cyber Security and Technology teams.

Responsibilities

• Monitor and investigate security alerts and suspicious activity.
• Perform initial triage to determine the nature, severity and potential impact of security events.
• Investigate suspicious activity across user accounts, endpoints, email, cloud services, network infrastructure and applications.
• Correlate information from available security tools to support investigations.
• Investigate suspected account compromise, malware, phishing and other potential cyber security incidents.
• Escalate significant or complex incidents through the incident management process.
• Maintain clear and accurate records of investigations, evidence, decisions and actions.
• Work with other technical teams to support containment and remediation activities.
• Support the investigation and response to cyber security incidents.
• Perform initial response activities per procedures and playbooks.
• Coordinate actions with other teams where required.
• Support collection and preservation of relevant evidence.
• Contribute to post-incident reviews and lessons learned.
• Identify opportunities to improve monitoring and response processes after incidents.
• Manage day-to-day operation of Cyberint Threat Intelligence platform.
• Review and assess alerts and intelligence from Cyberint.
• Investigate relevant external threats and risks.
• Assess relevance of threats or vulnerabilities to the organisation.
• Coordinate remediation or escalation with internal teams.
• Monitor emerging cyber threats and vulnerabilities.
• Provide updates on significant threats.
• Liaise with Cyberint and third parties for investigation support.
• Ensure Threat Intelligence findings are tracked through to resolution.
• The SOC Analyst will coordinate Threat Intelligence findings but remediation remains with owners.
• Support phishing and suspicious email investigations.
• Support investigations involving suspected compromised accounts or endpoints.
• Perform searches across security telemetry to support investigations.
• Assist with SOC investigation procedures and response playbooks.
• Identify recurring alerts or gaps and recommend improvements.
• Support testing and tuning of security monitoring.
• Work with other Cyber Security functions and Technology teams to resolve issues.
• Contribute to regular SOC reporting and metrics.

Skills

SOC experience

Investigation experience

SIEM/XDR/EDR

Cyber threats understanding

Identity/Endpoint/Network security

Security data analysis

Analytical skills

Documentation

Communication

Ownership of investigations

Team collaboration

Tools

Palo Alto Cortex XDR/XSIAM

Cyberint Threat Intelligence

Entra ID / Active Directory

EDR tooling

ThreatLocker

Silverfort

Phishing investigations

Threat hunting

Query languages / log analysis

PowerShell

Vulnerability management

Job description

Solutions 360, a service and technology services company of MDS Group is recruiting for a Security & Threat Intelligence Analyst, for a company within the group.

We are looking for a SOC Analyst to join the Cyber Security team, supporting the monitoring, investigation and response to cyber security threats across the organisation.

The role will be responsible for reviewing and investigating security alerts, supporting incident response activities and helping ensure security events are appropriately investigated, escalated and resolved.

The SOC Analyst will also take responsibility for the day-to-day operation of our Threat Intelligence capability, including management of the Cyberint platform, assessment of relevant external threats and coordination of appropriate actions with other teams.

This is a hands‑on role suited to someone with good general cyber security knowledge, strong investigative skills and the ability to work collaboratively across Cyber Security and Technology teams.

English language skills are an essential element of this role.

Key Role Responsibilities

Security Monitoring & Investigation

• Monitor and investigate security alerts and suspicious activity.
• Perform initial triage to determine the nature, severity and potential impact of security events.
• Investigate suspicious activity across user accounts, endpoints, email, cloud services, network infrastructure and applications.
• Correlate information from available security tools and data sources to support investigations.
• Investigate suspected account compromise, malware, phishing and other potential cyber security Incidents.
• Escalate significant or complex incidents through the appropriate incident management process.
• Maintain clear and accurate records of investigations, evidence, decisions and actions.
• Work with other technical teams to support containment and remediation activities.

Incident Response

• Support the investigation and response to cyber security incidents.
• Perform initial response activities in accordance with established procedures and playbooks.
• Coordinate actions with other Cyber Security and Technology teams where required.
• Support the collection and preservation of relevant evidence.
• Contribute to post-incident reviews and identification of lessons learned.
• Identify opportunities to improve security monitoring and response processes following incidents.

Threat Intelligence

• Manage the day-to-day operation of the organisation's Cyberint Threat Intelligence platform.
• Review and assess alerts and intelligence generated by Cyberint.
• Investigate relevant external threats, credential exposure, impersonation and other identified risks.
• Assess whether identified threats or vulnerabilities are relevant to the organisation.
• Coordinate remediation or escalation with the appropriate internal teams.
• Monitor significant emerging cyber threats and vulnerabilities that could affect the organisation.
• Provide concise updates on significant threats and findings where appropriate.
• Liaise with Cyberint and other third parties where additional investigation or support is required.
• Ensure Threat Intelligence findings are appropriately tracked through to resolution.

The SOC Analyst will coordinate and track Threat Intelligence findings but will not necessarily be responsible for implementing remediation. Remediation will remain with the relevant system, application or service owner.

SOC Operations

• Support phishing and suspicious email investigations.
• Support investigations involving suspected compromised accounts or endpoints.
• Perform searches across available security telemetry to support investigations.
• Assist with maintaining SOC investigation procedures and response playbooks.
• Identify recurring alerts, false positives or monitoring gaps and recommend improvements.
• Support testing and tuning of security monitoring where required.
• Work with other Cyber Security functions and Technology teams to resolve security issues.
• Contribute to regular SOC reporting and operational metrics.

Essential Skills & Experience

The successful candidate should have:

• Previous experience working within a SOC, Cyber Security Operations or similar security role.
• Practical experience investigating security alerts and incidents.
• Experience working with SIEM, XDR, EDR or similar security monitoring technologies.
• A good understanding of common cyber threats and attack techniques.
• A good understanding of identity, endpoint, email and network security concepts.
• Experience analysing security information from multiple sources to support an investigation.
• Good analytical and troubleshooting skills.
• Ability to clearly document technical investigations and findings.
• Ability to communicate effectively with both technical and non-technical stakeholders.
• Ability to take ownership of investigations and see them through to an appropriate conclusion.
• Ability to work effectively with other Cyber Security and Technology teams.

Desirable Skills & Experience

Experience with some of the following would be beneficial but is not essential:

• Palo Alto Cortex XDR / XSIAM.
• Threat Intelligence platforms, particularly Cyberint.
• Microsoft Entra ID and Active Directory.
• Endpoint detection and response technologies.
• ThreatLocker or similar application‑control technologies.
• Silverfort or other identity security platforms.
• Phishing and email security investigations.
• Threat hunting.
• Security query languages and log analysis.
• PowerShell or other scripting and automation technologies.
• Vulnerability management.
• Experience working within financial services or another regulated environment.
  

Who we are

We began in Portugal 40 years ago. Since then, we focus on specialisation and knowledge, on an international network, on people and on technology. We have innovated, grown and become a multinational group specialising in insurance and risk consulting.
With an active presence in 11 countries – Portugal, Brazil, Spain, Angola, Mozambique, Switzerland, Malta, Chile, Cyprus, Mexico and USA – we also operate around the world through Brokerslink, a global broking company, founded by MDS in 2004. Brokerslink manages a network of brokers and speciality risk and consulting firms located in 133 countries.
We are part of The Ardonagh Group, the world’s largest independent broking group in the United Kingdom and one of the top 20 brokers in the world, posting revenue over USD$1.5Bn, employing 11,000+ people across 250 offices. This operation amplifies our access to specialist resources, technology, and the ability to offer innovative solutions as well as the highest standards of service to our customers anywhere in the world.

Equal Opportunity Employer

MDSis an equal opportunity employer. All applicants will be considered and analysed regardless of ethnicity, religion, gender identity, sexual orientation, national origin, age, or disability status.

#MDS