Cybersecurity SOC Analyst

Kognitiv Inc.; United States; Remote; USD 79,000 - 124,000; Full time

Job summary

Kognitiv Inc. is seeking a Cybersecurity SOC Analyst to investigate security alerts, tune detection rules, and monitor data movement across its environment. You’ll support global operations with European time-zone coverage alongside North American security coverage.

The role emphasizes hands-on investigations, rule-writing, and collaboration across regions to improve incident response and threat intelligence.

Qualifications

• Hands-on SOC analyst experience investigating alerts and using SIEM platforms.
• Experience with data loss prevention and investigating potential data transfers.
• Proficiency in query languages or scripting for security analysis.

Responsibilities

• Monitor, triage and investigate security alerts across sources and mitigate incidents.
• Write and tune detection rules to correlate events and automate triage.
• Review DLP events to identify inappropriate data movements.
• Collaborate with teammates across regions to investigate security concerns.
• Apply understanding of IT and cloud architectures to distinguish anomalies.

Skills

SOC analysis

Incident response

SIEM experience

Scripting

Networking basics

Education

Bachelor's degree in a technical field

Tools

Rapid7

Splunk

Microsoft Sentinel

Cyberhaven

SentinelOne

Job description

At Kognitiv Inc., we’re redefining what it means to be a Workday partner. As one of the fastest-growing companies in the ecosystem, we bring deep expertise, innovative thinking, and a people-first mindset to everything we do. We’re not just building better Workday solutions—we’re building a company where talented people thrive.

Ready to do your best work? Join us.

About the Role

Kognitiv is hiring a Cybersecurity SOC Analyst to investigate security alerts, improve detection rules and monitor how sensitive data moves across our environment. You’ll support Kognitiv globally, adding European time-zone coverage alongside our North American security coverage.

What You’ll Do

• Monitor, triage and investigate security alerts in Rapid7 InsightIDR, bringing together logs from firewalls, endpoints and other devices, and help mitigate verified security incidents.
• Write and tune detection rules that correlate events across sources, including endpoint detection and response signals from SentinelOne. Identify opportunities to automate triage and reduce manual effort.
• Review DLP events in Cyberhaven to identify potentially inappropriate movement of client or company data, including transfers to personal email or AI platforms.
• Follow up with colleagues and their managers to understand flagged activity and investigate potential security concerns.
• Apply your understanding of the technology being protected to distinguish suspicious behavior from expected activity.
• Track emerging threats, malware and cloud vulnerabilities, and contribute findings to incident response playbooks and detection improvements.

What You’ll Bring

• Hands-on SOC analyst experience investigating alerts and working with SIEM platforms. We’re targeting experience typically gained over 2-4 years; this is not an entry-level role or an upper limit on experience.
• Practical experience with Rapid7, Splunk, Microsoft Sentinel or another SIEM. You should be able to explain how you’ve used the platform in real investigations; prior Rapid7 experience is not required.
• Experience working with DLP tools and investigating potential data loss or inappropriate data transfers.
• Querying, scripting or programming skills you can apply to security analysis and detection rules. Experience with LEQL, KQL, SPL or Python is relevant; you don’t need to know all of them.
• A broad understanding of IT systems, network protocols and cloud architectures, gained through a relevant technical degree or equivalent industry experience.
• Practical experience with endpoint detection and response (EDR) tools alongside your SIEM and DLP work.
• A methodical approach to active investigations and careful attention to log data, network traffic and subtle indicators of compromise.
• Curiosity and a willingness to keep learning as threats, vulnerabilities and attacker tactics evolve.

Nice to Have

• Experience with Rapid7, Cyberhaven or SentinelOne.
• Familiarity with MITRE ATT&CK or CIS Controls to support your analysis.
• Security+, CySA+, a relevant Splunk security certification or Rapid7 InsightIDR Certified Specialist. Certifications are helpful, not mandatory.
• SIEM engineering or log-platform configuration experience.

Location and Working Hours

This role is intended to be based in Europe and supports Kognitiv globally. You’ll generally work regular hours in your local time zone, with occasional later meetings to collaborate across regions. Visa sponsorship is not available.

Estimated Application Deadline

This job postings’ application deadline is an estimate, but ultimately the fill date is flexible and the job will remain open until filled. Any updates on deadlines will be communicated through this job posting.

2026-12-05

Kognitiv is an Equal Opportunity Employer: All applicants will receive consideration for employment without regard to age, ancestry, color, family or medical care leave, gender identity or expression, genetic information, marital status, medical condition, national origin, physical or mental disability, political affiliation, protected veteran status, race, religion, sex (including pregnancy), sexual orientation, or any other characteristic protected by applicable laws, regulations and ordinances. Kognitiv will consider for employment qualified applicants with arrest or conviction records in a manner consistent with the requirements of the law, including any applicable fair chance law.

Work Authorization: Applicants for employment in the country in which they are applying (Employing Country) must have work authorization that does not now or in the future require sponsorship of a visa for employment authorization in the Employing Country and with Kognitiv.

Candidates who are currently employed by a client of Kognitiv or an affiliated Kognitiv business may not be eligible for consideration.