SOC Analyst: Detect, Triage & Automate Security Alerts

Kognitiv; United States; Remote; USD 70,000 - 100,000; Full time

Job summary

Kognitiv is seeking a Security Operations role focused on investigating alerts, containing incidents, and enhancing SIEM monitoring. You will work across data from firewalls, endpoints, and other systems with coverage for European time zones.

Ideal candidates have 2–4 years in security operations and hands-on SIEM experience (Rapid7 InsightIDR, Splunk, or Microsoft Sentinel). Familiarity with DLP and EDR signals is preferred, with opportunities to automate triage and contribute to playbooks.

Qualifications

• 2–4 years in security operations.
• Hands-on SIEM experience with Rapid7 InsightIDR, Splunk, or Microsoft Sentinel.
• Experience with data loss prevention and investigating data movement concerns.
• Ability to interpret alerts to distinguish suspicious activity from normal behavior.
• Familiarity with EDR signals and cross-source correlation.
• Experience tuning detections or contributing to incident response playbooks.

Responsibilities

• Triage alerts using logs from firewalls, endpoints, and other systems; investigate suspicious activity and support incident mitigation.
• Create and refine detection rules that connect events across data sources, including endpoint signals.
• Review data loss prevention alerts involving possible transfers of client or company information to personal email or AI services.
• Follow up with staff and managers to understand flagged activity and assess whether it presents a security concern.
• Look for ways to automate alert triage and reduce repetitive investigation work.
• Track threats, malware, and cloud vulnerabilities, and contribute findings to response playbooks and detection updates.

Skills

Security operations

Incident response

SIEM

Threat detection

Data loss prevention

Communication

Tools

Rapid7 InsightIDR

Splunk

Microsoft Sentinel

Job description

Kognitiv is seeking a Security Operations role focused on investigating alerts, containing incidents, and enhancing SIEM monitoring. You will work across data from firewalls, endpoints, and other systems with coverage for European time zones.

Ideal candidates have 2–4 years in security operations and hands-on SIEM experience (Rapid7 InsightIDR, Splunk, or Microsoft Sentinel). Familiarity with DLP and EDR signals is preferred, with opportunities to automate triage and contribute to playbooks.