Security Operations Analyst – SIEM Operations, Threat Detection

Job not on LinkedIn

🔥 6 minutes ago

🇨🇿 Czechia – Remote

⏰ Full Time

🟡 Mid-level

🟠 Senior

🛡️ Security Operations

👻 Ghost score 11%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

Talan

WebsiteLinkedInAll Job Openings

1001 - 5000 employees

Founded 2003

💼 Consulting

🏢 Enterprise

☁️ SaaS

💰 Secondary Market on 2020-07

Consulting • Enterprise • SaaS

Talan is a global company specializing in supporting organizations through positive innovation and transformation. With a presence in 18 countries across 5 continents, Talan offers a diverse range of solutions that enhance decision-making, integrate technology into business strategies, and reinvent business models for resilience and operational excellence. Talan excels in data management and governance, AI-powered solutions, cybersecurity, and cloud platforms. By partnering with leading technology providers like Microsoft, SAP, Oracle, and Salesforce, Talan aims to democratize data use and drive low-carbon transitions. The company also focuses on industries such as energy, transport, financial services, and more, providing insights and solutions tailored to the specific needs of these sectors.

📋 Description

• Enhance threat detection and cybersecurity operations capabilities within the Cyber Security Operations Center • Develop, implement, validate, tune and maintain security monitoring, analytics and detection capabilities across SIEM, EDR, cloud and other cybersecurity platforms • Operate, maintain, optimize and continuously improve security monitoring and threat detection services • Onboard, integrate, test and validate security data sources, telemetry feeds and monitoring capabilities • Manage security content and detection use case lifecycles, including rule reviews, testing, tuning and content quality assurance • Collaborate with cyber threat intelligence, incident response and cybersecurity operations teams • Participate in cybersecurity architecture reviews and provide recommendations • Prepare and maintain cybersecurity operations metrics, dashboards, KPIs and service performance reports • Review detection effectiveness, monitoring configurations, operational processes and service deliverables • Analyze operational feedback to reduce false positives and improve detection quality • Contribute to quality assurance, process reviews, control validation, service quality assessments and corrective actions • Maintain CSOC procedures, standards, documentation, knowledge base articles and operational guidance • Prepare and present technical reports, summaries, findings and recommendations to stakeholders • Participate in rotating on-call coverage and resolve critical system incidents when required

🎯 Requirements

• +5 years of relevant experience in the information technology field, including triage of alerts and supporting security incidents • Proven experience administering a SIEM platform, preferably Splunk or Microsoft Sentinel SIEM • Proven experience with SOC tools such as SIEMs and EDRs • Ability to autonomously perform technical analysis of security threats and collaborate with the Incident Response team • Deep knowledge of Microsoft Security Tools, including M365, Cloud App Security, Azure, Defender for Endpoints, Azure Security, Azure Sentinel and XDR • Deep knowledge of cloud technologies, including Azure, AWS and GCP • Deep knowledge of SIEM tools such as Splunk, QRadar, ArcSight, MS Sentinel and ELK Stack • Knowledge of at least one EDR solution, such as MS Defender for Endpoint or CrowdStrike • Knowledge of email security, network monitoring and incident response • Linux, Mac and Windows knowledge • C1 English proficiency • Mandatory participation in a rotating 24/7 on-call schedule, approximately one full week every X months • Experience building SIEM architectures from initial design to implementation, including data ingestion pipelines for diverse cloud and on-premises log sources (nice to have) • Proven knowledge of monitoring AWS environments (IaaS, SaaS, PaaS) (nice to have) • Knowledge of at least one general-purpose or shell scripting language, such as Ruby, Bash, PowerShell or Python (nice to have) • Desirable certifications: MCSE, CCNA, Microsoft Azure SC-200, GCIH, CEH, GCFA or any GIAC/similar certification • Excellent communication skills • Customer-facing experience and oral communication skills • Ability to write documentation and reports • Creativity and ability to find innovative solutions • Willingness to learn on the job • Conflict management and cooperation

🏖️ Benefits

• Remote position • Freelance, full-time contract • Training and career development • Possibility to be part of a multicultural team • Work on international projects