Security Operation Analyst (Cyber Defense Operation)

Pragmatike is recruiting on behalf of a major international organization for a Security Operations Analyst to join a global Cybersecurity Operations team. You'll be part of a 24/7 Security Operations Centre (SOC) responsible for monitoring, detecting, investigating, and responding to cyber threats across enterprise, cloud, network, and endpoint environments. This is a hands-on security role focused on alert triage, threat investigation, log analysis, incident response, and security monitoring, working alongside cybersecurity specialists distributed across multiple regions.

Responsibilities

Monitor, triage, and investigate security alerts across SIEM, EDR, Microsoft security tools, and cloud platforms; Analyze host and network logs from Windows, Linux, databases, applications, web servers, firewalls, and NIDS/HIDS; Investigate suspicious activity, identify root causes, and determine appropriate remediation or escalation; Support incident response, remediation, and recovery activities; Work closely with Incident Response and other cybersecurity teams to manage security threats; Analyze network and security events using TCP/IP, syslog, firewall, and network monitoring data; Identify opportunities to improve detection quality and reduce false positives through tuning and optimization; Gather technical information from clients to improve security monitoring and detection; Prepare and present security reports, summaries, and technical findings; Contribute to SOC procedures, documentation, knowledge bases, and quality-control processes; Review operational feedback and implement corrective actions to continuously improve service quality

Requirements

5+ years of relevant experience in IT/cybersecurity, including security alert triage and incident support; Hands-on experience working in a SOC environment; Strong experience with SIEM and EDR platforms; Advanced log analysis skills across Windows/Linux, databases, applications, and infrastructure; Strong knowledge of Microsoft Security technologies, including Microsoft Sentinel and Defender; Experience with cloud security across Azure, AWS, and/or GCP; Experience with SIEM platforms such as Splunk, QRadar, ArcSight, Microsoft Sentinel, or ELK; Experience with at least one EDR solution such as Microsoft Defender for Endpoint or CrowdStrike; Knowledge of email security, network monitoring, and incident response; Strong knowledge of Linux, macOS, and Windows; Fluent English with excellent written and verbal communication skills

Nice to have

Experience working on an Incident Response team with Tier-1/Tier-2 incident triage; AWS security monitoring experience across IaaS, PaaS, or SaaS environments; Scripting experience with Python, PowerShell, Bash, Ruby, or similar; Certifications such as Microsoft SC-200, GCIH, CEH, GCFA, GIAC, CCNA, or MCSE; Customer-facing cybersecurity experience