Cybersecurity SOC Analyst

Kognitiv; United States; Remote; USD 70,000 - 100,000; Full time

Job summary

Kognitiv is seeking a Security Operations role focused on investigating alerts, containing incidents, and enhancing SIEM monitoring. You will work across data from firewalls, endpoints, and other systems with coverage for European time zones.

Ideal candidates have 2–4 years in security operations and hands-on SIEM experience (Rapid7 InsightIDR, Splunk, or Microsoft Sentinel). Familiarity with DLP and EDR signals is preferred, with opportunities to automate triage and contribute to playbooks.

Qualifications

• 2–4 years in security operations.
• Hands-on SIEM experience with Rapid7 InsightIDR, Splunk, or Microsoft Sentinel.
• Experience with data loss prevention and investigating data movement concerns.
• Ability to interpret alerts to distinguish suspicious activity from normal behavior.
• Familiarity with EDR signals and cross-source correlation.
• Experience tuning detections or contributing to incident response playbooks.

Responsibilities

• Triage alerts using logs from firewalls, endpoints, and other systems; investigate suspicious activity and support incident mitigation.
• Create and refine detection rules that connect events across data sources, including endpoint signals.
• Review data loss prevention alerts involving possible transfers of client or company information to personal email or AI services.
• Follow up with staff and managers to understand flagged activity and assess whether it presents a security concern.
• Look for ways to automate alert triage and reduce repetitive investigation work.
• Track threats, malware, and cloud vulnerabilities, and contribute findings to response playbooks and detection updates.

Skills

Security operations

Incident response

SIEM

Threat detection

Data loss prevention

Communication

Tools

Rapid7 InsightIDR

Splunk

Microsoft Sentinel

Job description

Role overview

Investigate security alerts and help contain verified incidents as part of a global security operations function. The work centers on SIEM monitoring, detection improvements, and reviewing potential exposure of sensitive data, with coverage for European time zones.

Responsibilities

• Triage alerts using logs from firewalls, endpoints, and other systems; investigate suspicious activity and support incident mitigation.
• Create and refine detection rules that connect events across data sources, including endpoint security signals.
• Review data loss prevention alerts involving possible transfers of client or company information to personal email or AI services.
• Follow up with staff and managers to understand flagged activity and assess whether it presents a security concern.
• Look for ways to automate alert triage and reduce repetitive investigation work.
• Track relevant threats, malware, and cloud vulnerabilities, and contribute findings to response playbooks and detection updates.

Requirements

• Hands-on experience in security operations investigating alerts; the role is aimed at experience commonly developed over roughly 2–4 years, but that range is not a hard limit.
• Practical experience using a SIEM such as Rapid7 InsightIDR, Splunk, or Microsoft Sentinel, with examples of its use in real investigations.
• Experience with data loss prevention tools and investigating potential data movement concerns.
• Ability to interpret the technology and context behind an alert to distinguish suspicious activity from expected behavior.
• Familiarity with endpoint detection and response signals and correlating events from multiple sources.

Nice to have

• Experience tuning detections, automating triage, or contributing to incident response playbooks.