Security Operations Analyst (L1-L2)

justmarkets; USA; Remote; USD 65.000 - 90.000; Vollzeit

Benefits dieser Stelle

Remote work

Annual leave 20 days

Sick leave 10 days

Public holidays

Education budget

Wellness budget

Zusammenfassung

justmarkets is seeking a security operations triage analyst to review alerts, enrich cases with endpoint, identity, network, and service data, and determine confirmed threats. You will document evidence, maintain an incident timeline, and escalate high-risk findings.

Remote work is available, with standard annual leave and holidays. The ideal candidate has 1+ year hands-on alert triage experience, familiarity with SIEMs (and EDR/XDR), and knowledge of common attack patterns and MITRE ATT&CK.

Qualifikationen

• At least 1 year of commercial alert triage experience using a SIEM.
• Ability to write basic SIEM searches and filter events.
• Ability to interpret endpoint, identity, network, and cloud audit data.
• Familiarity with MITRE ATT&CK framework and threat intel.

Aufgaben

• Review alerts and determine if they indicate a genuine security concern.
• Enrich cases by correlating endpoint, identity, network, and service data.
• Investigate scope, record evidence, and maintain an incident timeline.
• Close false positives and escalate high-risk cases.
• Write handover notes and contribute to runbooks.

Kenntnisse

SIEM triage

EDR familiarity

XDR familiarity

KQL

EQL

data correlation

incident handling

Tools

SIEM

EDR

XDR

KQL

EQL

Jobbeschreibung

Role overview

Triage and investigate security alerts as part of a security operations team. You’ll gather context from security and business data, determine whether activity appears malicious or benign, document your findings, and escalatinants that may pose significant risk. The role is suited to someone with at least a year of hands‑on alert triage experience.

Responsibilities

• Review prioritized alerts and assess whether they indicate a genuine security concern.
• Enrich cases by correlating endpoint, identity, network, service, asset, and user information.
• Investigate initial scope and severity, record evidence and reasoning, and maintain a clear incident timeline.
• Close false positives and take approved low‑risk actions.
• Escalate suspected incidents, privileged account concerns, and cases with potentially broad or production impact.
• Write useful handover notes and contribute to better case practices and runbooks.

Requirements

• At least one year of commercial alert triage experience using a SIEM, with working familiarity with EDR or XDR and case‑management processes.
• Ability to write basic SIEM searches, filter events, and correlate activity across data sources; familiarity with query languages such as KQL or EQL is relevant.
• Ability to interpret common endpoint, identity, authentication, network, DNS, HTTP, and service or cloud audit data.
• Working knowledge of Windows, Linux, TCP/IP, access controls, and common attack patterns including phishing, credential abuse, and malware execution.
• Ability to distinguish malicious activity from benign events, estimate preliminary severity, identify affected users or assets, and flag uncertainty.
• Familiarity with indicators of compromise, reputation checks, threat intelligence, and the MITRE ATT&CK framework.
• Clear documentation of evidence, actions, conclusions, and escalations.

Nice to have

• Basic Python or PowerShell scripting for investigation or enrichment.
• Exposure to cloud, email security, SaaS audit logs, or phishing investigations.
• Practical cybersecurity lab experience, an entry‑level security certification, or macOS familiarity.

Benefits and work setup

• Remote work, 20 paid vacation days, 10 paid sick days, and public holidays.
• Budgets for medical care, professional education, language learning, and wellness expenses.