SOC Analyst - Junior / Middle (L1 / L2)

Job Responsibilities

• Continuously monitor and analyze information security events and alerts using data from SIEM, EDR/XDR, NGFW, WAF, Email Security, and other security and monitoring systems.
• Perform initial security event assessment (triage), classification, and prioritization, distinguishing false positives from potential or confirmed information security incidents.
• Escalate confirmed, suspicious, or high-risk security events and incidents in accordance with established procedures and playbooks/runbooks.
• Analyze logs and other technical data from Windows, Linux, Active Directory, network, endpoint, and information security systems to identify suspicious or malicious activity.
• Investigate security alerts and incidents by determining their source, timeline, potential attack vector, scope of impact, and the systems, devices, and user accounts involved.
• Analyze EDR/XDR data, including process trees, command lines, file activity, network connections, registry activity, and other endpoint telemetry, to identify potentially malicious actions.
• Verify, analyze, and enrich suspicious indicators and artifacts, including IP addresses, domains, URLs, file hashes, processes, user accounts, hosts, and other Indicators of Compromise (IOCs).
• Analyze suspicious, phishing, and security-system-blocked emails, including sender information, email headers, URLs, attachments, reputation, and other relevant data.
• Review emails blocked or quarantined by Email Security systems and, where no security risks are identified, release or allow them in accordance with established procedures.
• Map identified attack activities, tactics, and techniques to the MITRE ATT&CK framework to assess attack progression and potential next steps.
• Participate in incident response activities, including Identification, Analysis, Containment, Eradication, and Recovery, within established procedures and assigned authority.
• Document security event and incident investigations, findings, actions taken, and results in the relevant ticketing or incident management systems.
• Prepare technical incident reports and contribute to collecting and analyzing key SOC metrics, including MTTD, MTTR, alert and incident statistics, and other performance indicators.

Development of Security Monitoring and Detection Systems

• Participate in the implementation, configuration, integration, administration, and continuous improvement of security monitoring and detection solutions, including SIEM, EDR/XDR, IDS/IPS, Network Security Monitoring, and other security monitoring tools.
• Participate in designing, connecting, and implementing new monitoring sources, including log source onboarding, log collection, parsing/normalization, correlation, alerting, and appropriate data retention mechanisms.
• Develop, configure, test, and improve SIEM detection rules, correlation rules, use cases, alerting logic, decoders/parsers, and dashboards to ensure their effectiveness and alignment with monitoring requirements.
• Contribute to developing and implementing new detection use cases based on MITRE ATT&CK techniques, identified threats, and risks specific to the Bank’s infrastructure.
• Develop and improve SOC playbooks/runbooks for detecting, analyzing, escalating, and responding to various security events and incidents.
• Participate in designing, developing, testing, and implementing new security monitoring tools, integrations, automations, and internal solutions as needed.
• Contribute to reducing false positives, expanding detection coverage, and continuously improving the SOC’s detection and response capabilities.
• Participate in threat hunting to proactively search for potentially undetected or suspicious activity.
• Participate in Purple Team / Adversary Simulation exercises with Security Testing / Penetration Testing and other relevant teams to assess and improve detection and response capabilities.

Information Security Operations

• Perform information security operations related to granting, modifying, and revoking access to information systems and resources in accordance with approved requests, assigned authorization levels, and access control procedures.
• Verify access requests against established requirements and approvals, ensuring their implementation or referral to the responsible department when necessary.
• Participate in periodic reviews and monitoring of user access rights and privileges.
• Perform operational tasks related to Email Security systems, including reviewing blocked or quarantined messages, analyzing false positives, and releasing permitted messages in accordance with established procedures.
• Process other operational security requests received from information security systems and users in accordance with established procedures, SLAs, and assigned authority.
• Document operational activities and ensure their traceability in the relevant ticketing/request management systems.
• Collaborate with the Bank’s departments on incident investigation and response, monitoring system development, and operational information security processes.
• Stay informed about current cyber threats, attack techniques, vulnerabilities, and IOCs/TTPs, applying this knowledge to SOC monitoring, detection, and incident response processes.

Required Qualifications and Skills

• For the Junior (L1) level, commercial work experience is not mandatory if the candidate has relevant technical knowledge and practical skills gained through training programs, home labs, CTFs, internships, or other hands-on activities.
• For the Middle (L2) level, at least 2 years of relevant experience in SOC, security monitoring, incident response, or a related field is preferred.
• Higher education or equivalent professional experience in information security, cybersecurity, information technology, computer science, or a related field.
• Knowledge of fundamental information security principles, common cyber threats, and major attack techniques.
• Good understanding of TCP/IP, DNS, HTTP/HTTPS, TLS, SMTP, DHCP, and other fundamental network protocols and communication principles.
• Knowledge of Windows and Linux operating systems and their fundamental security mechanisms.
• General understanding of Active Directory architecture and operation, authentication and authorization mechanisms, users and groups, Group Policy, and key security events.
• Ability to read and perform initial analysis of Windows Event Logs, Linux logs, firewall/network logs, authentication logs, and other security logs.
• Understanding of SIEM fundamentals, including log collection, parsing/normalization, correlation, detection rules, use cases, and alerting.
• General understanding of EDR/XDR operation and core endpoint detection and response mechanisms.
• Knowledge of the purpose and basic operating principles of NGFW, IDS/IPS, WAF, Email Security, antivirus/endpoint security, and other defensive systems.
• Knowledge of access control principles, including least privilege, need-to-know, authentication, and authorization.
• Understanding of IOCs (Indicators of Compromise) and TTPs (Tactics, Techniques, and Procedures) and their use in SOC and incident response processes.
• General knowledge of the MITRE ATT&CK framework, including tactics, techniques, and procedures.
• Understanding of the main incident response phases: Identification, Analysis, Containment, Eradication, and Recovery.
• Ability to perform initial analysis of phishing emails, suspicious URLs, files, and other common threats.
• Analytical thinking and the ability to correlate technical data from different sources and identify cause-and-effect relationships between events.
• Ability to clearly document security events, incidents, and actions taken.
• Sufficient English proficiency to read technical documentation, security alerts, threat intelligence data, security advisories, and other professional materials.
• Responsibility, attention to detail, discipline, the ability to work under pressure, and adherence to established procedures.
• Willingness to work a 24/7 shift schedule.

Preferred Qualifications

• Practical experience in SOC analysis, incident response, Blue Team, system administration, or network administration.
• Experience working with SIEM systems.
• Experience installing, initially configuring, administering, and troubleshooting SIEM/security monitoring systems.
• Experience creating and configuring detection/correlation rules, decoders/parsers, log normalization, or use cases in SIEM systems.
• Experience integrating and onboarding new log sources, including Syslog, Windows Event Forwarding, agent/API-based collection, and other mechanisms.
• Experience with SPL, KQL, Lucene / OpenSearch Query DSL, or other SIEM/search query languages.
• Experience working with EDR/XDR/endpoint security solutions.
• Experience analyzing logs and security events from network security (NGFW), application security (WAF), Email Security, and Privileged Access Management systems.
• Experience analyzing Windows Event IDs, Sysmon, PowerShell logging, and Active Directory security events.
• Experience investigating phishing, malware, brute-force attacks, password spraying, suspicious PowerShell activity, credential access, persistence, privilege escalation, and lateral movement.
• Experience working with threat intelligence sources and platforms, as well as IOC enrichment tools.
• Experience in network traffic analysis and using Wireshark / tcpdump.
• Knowledge of malware analysis or digital forensics fundamentals.
• Experience participating in threat hunting, detection engineering, or Purple Team activities.
• Experience integrating and automating security monitoring solutions using APIs, webhooks, Syslog, or other integration mechanisms.
• Basic knowledge of at least one of Python, PowerShell, or Bash, with the ability to understand, modify, or create simple scripts to automate SOC monitoring, log processing, IOC enrichment, or incident response tasks.
• Experience working with security events from Active Directory / Entra ID, Microsoft 365 / Exchange Online, or equivalent identity and cloud services.
• Experience working in banking, financial services, or other regulated or critical infrastructure environments.
• Relevant professional certifications, such as CompTIA Security+, CySA+, Blue Team Level 1 (BTL1), Microsoft SC-200, CCD, HTB CDSA, or equivalent. For Middle-level candidates, advanced certifications such as GCIH, GCIA, or equivalent are an additional advantage.
• Hands-on training and skills development through Hack The Box, TryHackMe, LetsDefend, CyberDefenders, Blue Team Labs Online, Microsoft Learn, Cisco Networking Academy, or equivalent specialized platforms. Completed labs, challenges, CTFs, home lab projects, and other practical achievements will be considered an additional advantage.

What We Expect from the Candidate

A practical interest in Blue Team, SOC, threat detection, and incident response; the ability to understand cause-and-effect relationships between security events, correlate data from different sources, and distinguish genuine threats from routine or false-positive events.

The role is not limited to monitoring existing security alerts. The specialist will also contribute to developing security monitoring and detection systems, from onboarding and integrating new log sources to creating and improving detection rules, correlation logic, dashboards, playbooks, and automations.

For the Junior (L1) level, we expect a solid technical foundation, willingness to learn, attention to detail, and the ability to follow established playbooks/runbooks and procedures. Candidates without prior SOC experience may be considered based on relevant practical knowledge and skills they can demonstrate.

For the Middle (L2) level, we expect the ability to independently investigate security events and incidents, assess their impact and scope, and make well-founded decisions regarding escalation and response. The role also requires the ability to independently configure and develop security monitoring systems, integrate new log sources, create detection use cases, and continuously improve the SOC’s detection and response capabilities.

The position also includes routine information security operations, such as implementing access provisioning and modification processes, reviewing and approving the release of blocked emails, and processing other relevant security requests.

Application period

Start date: September 2, 2026

Closing date: October 15, 2026