Senior SOC Analyst (Remote)

Large incident response engagements can involve 20 or more responders working in shifts for weeks. Clifflight protects more than 4,000 organisations, from regional hospitals to Fortune 500 manufacturers. Training budget covers one SANS course or equivalent per year.

About the role:

We're looking for a Senior SOC Analyst (Remote) to join our team. This is a remote role. Security analyst role covering detection, incident response and some compliance work. Good fit for someone two or three years into security. This role is fully remote within Spain. Day-to-day communication is in Slack and Google Meet.

What you'll be doing:

• Report on security awareness training and phishing simulation results
• Write and update SOC runbooks and playbooks
• Document incidents with timeline, impact and root cause
• Investigate endpoint alerts in CrowdStrike Falcon, SentinelOne or Defender for Endpoint
• Escalate confirmed incidents and follow the incident response plan
• Check threat intelligence feeds and IOCs against our environment
• Hand off open cases at shift change with clear notes
• Monitor and triage alerts in Splunk, Microsoft Sentinel, QRadar or Elastic SIEM

Qualifications:

• 5+ years in an SOC, security analyst or IT security role
• Working knowledge of SIEM and EDR tools
• Understanding of TCP/IP, DNS, HTTP and common ports and protocols
• CompTIA Security+ or equivalent (or ability to obtain within six months)
• Basic scripting in PowerShell or Python
• Must be able to pass a background check
• Clear written communication for incident tickets and reports

Nice to have:

• Malware analysis in a sandbox
• KQL or SPL query writing
• SOAR platforms such as Splunk SOAR, Cortex XSOAR or Tines

Schedule: Rotating 12-hour shifts on a 2-2-3 schedule, including nights

€46,000 - €60,000/year

What we offer:

• Private health insurance
• Flexible start and finish times
• Meal vouchers

Shortlisted candidates will hear from us within two weeks.

Start: Flexible.

Demo job created on 11jobs for testing and demonstrations. It is not an actual opening at Clifflight S.L..