Security Operations Analyst (Cyber Defense Operations)

Pragmatike is recruiting on behalf of a major international organization for a Security Operations Analyst to join a global Cybersecurity Operations team. The role is part of a 24/7 Security Operations Centre (SOC) responsible for monitoring, detecting, investigating, and responding to cyber threats across enterprise, cloud, network, and endpoint environments. It is a hands-on security role focused on alert triage, threat investigation, log analysis, incident response, and security monitoring, working alongside cybersecurity specialists distributed across multiple regions. Employment: Full-Time Contract. Duration: 6 months, with potential extension. Industry: Cybersecurity / Cloud / Enterprise Security.

Responsibilities

Monitor, triage, and investigate security alerts across SIEM, EDR, Microsoft security tools, and cloud platforms; Analyze host and network logs from Windows, Linux, databases, applications, web servers, firewalls, and NIDS/HIDS; Investigate suspicious activity, identify root causes, and determine appropriate remediation or escalation; Support incident response, remediation, and recovery activities; Work closely with Incident Response and other cybersecurity teams to manage security threats; Analyze network and security events using TCP/IP, syslog, firewall, and network monitoring data; Identify opportunities to improve detection quality and reduce false positives through tuning and optimization; Gather technical information from clients to improve security monitoring and detection; Prepare and present security reports, summaries, and technical findings; Contribute to SOC procedures, documentation, knowledge bases, and quality-control processes; Review operational feedback and implement corrective actions to continuously improve service quality

Requirements

5+ years of relevant experience in IT/cybersecurity, including security alert triage and incident support; Hands-on experience working in a SOC environment; Strong experience with SIEM and EDR platforms; Advanced log analysis skills across Windows/Linux, databases, applications, and infrastructure; Strong knowledge of Microsoft Security technologies, including Microsoft Sentinel and Defender; Experience with cloud security across Azure, AWS, and/or GCP; Experience with SIEM platforms such as Splunk, QRadar, ArcSight, Microsoft Sentinel, or ELK; Experience with at least one EDR solution such as Microsoft Defender for Endpoint or CrowdStrike; Knowledge of email security, network monitoring, and incident response; Strong knowledge of Linux, macOS, and Windows; Fluent English with excellent written and verbal communication skills

Nice to have

Experience working on an Incident Response team with Tier-1/Tier-2 incident triage; AWS security monitoring experience across IaaS, PaaS, or SaaS environments; Scripting experience with Python, PowerShell, Bash, Ruby, or similar; Certifications such as Microsoft SC-200, GCIH, CEH, GCFA, GIAC, CCNA, or MCSE; Customer-facing cybersecurity experience