Security Operations Analyst (L1-L2)

JustMarkets; United States; Hybrid; USD 70,000 - 110,000; Full time

Benefits offered by this job

20 paid vacation days per year

10 paid sick leave days per year

Public holidays as per the company's P

Medical budget

Opportunity to work remotely

Professional education budget

Language learning budget

Wellness budget (gym membership, sport

Job summary

JustMarkets is seeking a Security Operations Analyst to join our US-based team full-time. You will monitor alerts, perform initial investigations, and document findings in the case-management system, ensuring timely triage and escalation when needed.

The ideal candidate has 1+ year of hands-on security experience with SIEM, EDR/XDR, and basic scripting. You will work with Windows and Linux, TCP/IP, DNS, and common attack patterns while contributing to runbooks and incident response readiness.

Qualifications

• 1+ year of commercial hands-on experience in security alert triage.
• Working knowledge of SIEM, EDR/XDR, and case-management workflows.
• Ability to interpret telemetry from endpoints, identity, network, DNS, and cloud.

Responsibilities

• Monitor prioritized alert queues and validate real risk.
• Enrich cases with context from multiple data sources.
• Conduct initial investigations and document reasoning in the case-management system.
• Close false positives and execute approved low-risk actions.
• Escalate incidents to L2, the manager, or Incident Response when needed.
• Maintain handover notes and contribute to runbooks.

Skills

Security alert triage

SIEM experience

EDR/XDR knowledge

Case-management workflows

KQL

EQL

Windows & Linux basics

Networking basics (TCP/IP, DNS)

Tools

Case-management system

Job description

We are inviting you, a highly motivated and results-oriented Security Operations Analyst to join our team on a full-time basis.

Our team has unique expertise in research, analysis, and product development. By relying on technical insights and a data-driven approach, we create disruptive future-defining innovations of the fin-tech industry that remain our basis for success.

Responsibilities

• Monitor prioritized alert queues and validate whether alerts indicate real risk
• Enrich cases and correlate relevant endpoint, identity, authentication, network, service, asset, user, timeline, and business context
• Perform initial investigations, classify alerts, assess preliminary severity and scope, and document the evidence and reasoning in the case-management system
• Close false positives and execute approved low-risk actions
• Escalate suspected incidents, privileged-account issues, and high-impact or production-impact cases to L2, the manager, or Incident Response
• Maintain clear handover notes and support improvements to case quality and runbooks

Requirements

• 1+ year of commercial hands-on experience in security alert triage, utilizing at least one SIEM platform, with working knowledge of EDR/XDR and case-management workflows.
• Ability to build basic searches or queries, filter security events, and correlate related activity across more than one data source (Experience with basic SIEM query languages such as KQL, EQL)
• Ability to interpret common endpoint, identity, authentication, network, DNS, HTTP, and service or cloud audit telemetry at an initial-investigation level
• Working fundamentals of Windows and Linux, TCP/IP, DNS, HTTP, authentication, access control, and common attack patterns such as phishing, credential abuse, malware execution, and suspicious account activity
• Ability to distinguish true positives, false positives, and benign activity; assign a preliminary severity; identify affected users or assets; and recognize when scope or impact is uncertain
• Basic use of indicators of compromise, reputation sources, and threat-intelligence context, with awareness of the MITRE ATT&CK framework
• Ability to create a concise investigation timeline and document evidence, actions, conclusions, and handover or escalation notes in a case-management system

Will be a plus

• Simple Python or PowerShell scripts for investigation and enrichment
• Exposure to cloud, email-security, or SaaS audit logs and common phishing-investigation workflows
• Practical cybersecurity labs or an entry-level certification such as Security+ or CySA+
• Experience with MacOS

We offer

• 20 paid vacation days per year
• 10 paid sick leave days per year
• Public holidays as per the company's approved Public holiday list
• Medical budget
• Opportunity to work remotely
• Professional education budget
• Language learning budget
• Wellness budget (gym membership, sports gear and related expenses)