SOC Analyst III

The product is a mobile app plus a React web dashboard, with a Python and PostgreSQL backend on AWS.

Job summary:

Looking for an SOC Analyst III who wants to stay somewhere for a while. The SOC team runs a 24/7 SOC. We need someone who can work through an alert queue and tell which ones matter. Remote position. Most of the team is in Aalborg, but nobody is required to come in. You will write a lot of updates, so clear written English is important.

In this role you will:

Document incidents with timeline, impact and root cause. Review firewall, proxy, VPN and authentication logs for suspicious activity. Check threat intelligence feeds and IOCs against our environment. Monitor and triage alerts in Splunk, Microsoft Sentinel, QRadar or Elastic SIEM. Write and update SOC runbooks and playbooks. Escalate confirmed incidents and follow the incident response plan.

What we're looking for:

7+ years in an SOC, security analyst or IT security role. Ability to work shifts, including some nights, weekends or holidays as scheduled. Familiarity with the MITRE ATT&CK framework. Clear written communication for incident tickets and reports. Experience reading Windows Event Logs, Sysmon and Linux logs.

Schedule: Second shift, 2:00 PM to 10:30 PM, Monday to Friday

Pay and benefits:

Flexible working hours. Training budget.

We look at every application, usually within a week.

Candidates must be eligible to work in Denmark.

Duration: 3 months. Start: Immediately.

Demo job created on 11jobs for testing and demonstrations. It is not an actual opening at Sjælland Labs.