Senior SOC Analyst: Cloud Threat Detection (Remote)

ITDSPortugal.pt Todos; United States; Remote; USD 75,000 - 104,000; Full time

Job summary

Senior SOC Analyst – Cloud Security & Threat Detection requires hands-on security monitoring across multi-cloud environments, incident response, and continuous improvement of detection use-cases.

The role involves real-time alert handling with SIEM, EDR/XDR, Cloud security tooling, and collaboration with security engineering teams worldwide. Remote work is supported from Portugal, with 24/7 shift coverage and strict incident documentation standards.

Qualifications

• SOC/monitoring/incident response experience (1+ year Tier1, 3+ years Tier2).
• Hands-on with a SIEM platform (Elastic SIEM, Splunk, MS Sentinel, QRadar, or similar).
• Experience with EDR/XDR tools (CrowdStrike Falcon, Defender, XDR).
• Familiar with cloud native security on AWS/Azure/GCP.
• Strong incident documentation in a ticketing system.

Responsibilities

• Monitor security alerts across the digital footprint using SIEM, network detection, and EDR/XDR; perform initial validation.
• Investigate verified alerts; correlate endpoint, cloud, and network telemetry to reconstruct timelines.
• Monitor cloud workloads using native security tooling in AWS, Azure, or GCP.
• Contribute to detection use-cases and build security automation workflows (Cortex XSOAR).
• Execute containment actions per playbooks; isolate hosts, block networks, or revoke credentials.
• Document findings, log artifacts, and escalate high-severity incidents to Tier 3.

Skills

SIEM platforms

EDR/XDR tooling

Cloud platforms (AWS/Azure/GCP)

Threat detection

Incident response

Cortex XSOAR

Security automation

TCP/IP knowledge

MITRE ATT&CK

Python scripting

English communication

Tools

Elastic SIEM

Splunk

Microsoft Sentinel

IBM QRadar

CrowdStrike Falcon

Darktrace

Cortex XSOAR

Kubernetes

Job description

Senior SOC Analyst – Cloud Security & Threat Detection requires hands-on security monitoring across multi-cloud environments, incident response, and continuous improvement of detection use-cases.

The role involves real-time alert handling with SIEM, EDR/XDR, Cloud security tooling, and collaboration with security engineering teams worldwide. Remote work is supported from Portugal, with 24/7 shift coverage and strict incident documentation standards.