- Company Name
- Nomios Netherlands
- Job Title
- 24/7 SOC Analyst (L2)
- Job Description
-
Job Title: 24/7 SOC Analyst (L2)
Role Summary:
Responsible for continuous monitoring, triage, investigation, and escalation of security events across multiple customer environments. Utilises SIEM, EDR/XDR, and XSOAR platforms to analyze attacker behaviour, support threat hunting, and enhance SOC capabilities. Works closely with senior analysts and contributes to SOC process improvement.
Expactations:
- One year of SOC experience or three years of infrastructure/networking roles with security exposure.
- Ability to work 24/7 shifts in a fast‑paced environment.
- Strong analytical mindset, excellent written and verbal communication, and a proactive, teamwork‑oriented attitude.
Key Responsibilities:
- Monitor and triage alerts from SIEM, EDR/XDR, email, and web security solutions.
- Investigate suspicious activity, build detailed timelines, and maintain concise investigation notes.
- Escalate complex incidents to senior analysts with context‑rich documentation.
- Participate in directed threat‑hunting exercises and suggest improvements to detections, dashboards, and runbooks.
- Support testing of new use cases and detection logic.
- Provide clear written updates for customers and internal stakeholders.
- Perform shift handovers to ensure continuity.
- Collaborate with senior analysts to develop technical depth and analytical skills.
Required Skills:
- Experience triaging and investigating security alerts.
- Knowledge of attacker TTPs, malware execution chains, and MITRE ATT&CK.
- Ability to recognise indicators of compromise such as unusual processes, network connections, or irregular logon activity.
- Hands‑on experience with at least one major security platform (SIEM, EDR, or XDR).
- Familiarity with ticketing tools (ServiceNow, Salesforce, JIRA).
- Proficiency in reading Windows event logs, authentication logs, and basic process trees; comfortable with Windows, macOS, and Linux.
- Understanding of core network protocols (DNS, HTTP, SMB, LDAP).
- Operational knowledge of Windows, macOS and Linux.
- Ability to interpret logs from multiple sources and differentiate legitimate admin activity from suspicious behaviour.
Desirable/Additional Skills:
- Experience with Microsoft Sentinel, Google SecOps, or other SIEM platforms.
- Experience with Defender, CrowdStrike, SentinelOne, or other XDR solutions.
- Querying skills in KQL, CQL, S1QL, XQL or similar.
- Awareness of threat intelligence concepts.
- Basic coding or scripting proficiency (preferred but not required).
Required Education & Certifications:
- No formal education requirement stated; a high school diploma or equivalent is sufficient.
- A bachelor’s degree in Computer Science, Cybersecurity or related field is advantageous.
- Relevant certifications such as CompTIA Security+, EC-Council CEH, or vendor‑specific (SentinelOne, CrowdStrike, Microsoft Defender, etc.) are considered a plus.
Basingstoke, United kingdom
On site
20-11-2025