Cybersecurity Analyst I

Large incident response engagements can involve 20 or more responders working in shifts for weeks. Clifflight protects more than 4,000 organisations, from regional hospitals to Fortune 500 manufacturers. Training budget covers one SANS course or equivalent per year.

The position

This is a new role. The team has doubled in size over the past year. This role handles alert triage, phishing investigations and vulnerability tracking for about 3,000 endpoints. Clifflight is hiring for the Cybersecurity Analyst I role to monitor, investigate and respond to security alerts across our environment. Remote, open to candidates across Spain.

Your responsibilities

• Escalate confirmed incidents and follow the incident response plan
• Hand off open cases at shift change with clear notes
• Run vulnerability scans with Tenable Nessus, Qualys or Rapid7 and track remediation with system owners
• Help with user access reviews and offboarding audits
• Report on security awareness training and phishing simulation results
• Write and update SOC runbooks and playbooks
• Check threat intelligence feeds and IOCs against our environment
• Tune noisy detection rules with the security engineering team

What you need

• 0-2 years in an SOC, security analyst or IT security role
• Ability to work shifts, including some nights, weekends or holidays as scheduled
• Familiarity with the MITRE ATT&CK framework
• CompTIA Security+ or equivalent (or ability to obtain within six months)
• Understanding of TCP/IP, DNS, HTTP and common ports and protocols
• Experience reading Windows Event Logs, Sysmon and Linux logs
• Basic scripting in PowerShell or Python

Preferred qualifications

• Malware analysis in a sandbox
• Cloud log analysis (CloudTrail, Entra ID sign-in logs)

Schedule: Rotating 12-hour shifts on a 2-2-3 schedule, including nights

Benefits

• Private health insurance
• Life insurance
• Meal vouchers

Please mention your notice period and expected salary.

Start: Flexible.

Demo job created on 11jobs for testing and demonstrations. It is not an actual opening at Clifflight S.L..