Security Operations Analyst – SIEM Operations, Threat Detection

🔥 56 minutes ago

🇵🇱 Poland – Remote

⏰ Full Time

🟡 Mid-level

🟠 Senior

🛡️ Security Operations

👻 Ghost score 11%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

Talan

WebsiteLinkedInAll Job Openings

1001 - 5000 employees

Founded 2003

💼 Consulting

🏢 Enterprise

☁️ SaaS

💰 Secondary Market on 2020-07

Consulting • Enterprise • SaaS

Talan is a global company specializing in supporting organizations through positive innovation and transformation. With a presence in 18 countries across 5 continents, Talan offers a diverse range of solutions that enhance decision-making, integrate technology into business strategies, and reinvent business models for resilience and operational excellence. Talan excels in data management and governance, AI-powered solutions, cybersecurity, and cloud platforms. By partnering with leading technology providers like Microsoft, SAP, Oracle, and Salesforce, Talan aims to democratize data use and drive low-carbon transitions. The company also focuses on industries such as energy, transport, financial services, and more, providing insights and solutions tailored to the specific needs of these sectors.

📋 Description

• Contribute to the development, implementation, validation, tuning and maintenance of security monitoring, analytics and detection capabilities across SIEM, EDR, cloud and other cybersecurity platforms • Support the operation, maintenance, optimization and continuous improvement of security monitoring and threat detection services • Participate in onboarding, integration, testing and validation of security data sources, telemetry feeds and monitoring capabilities • Contribute to security content management, including use case lifecycle management, rule reviews, testing, tuning and content quality assurance • Collaborate with cyber threat intelligence, incident response and cybersecurity operations teams to translate requirements into detection and monitoring capabilities • Participate in cybersecurity architecture reviews and provide recommendations to improve security monitoring and detection effectiveness • Prepare and maintain cybersecurity operations metrics, dashboards, KPIs and service performance reports • Review and assess detections, monitoring configurations, operational processes and service deliverables, identifying improvement opportunities • Analyze operational feedback to support tuning, optimization, false-positive reduction and improved detection quality • Contribute to quality assurance activities, process reviews, control validation, service quality assessments and corrective actions • Support development, review and maintenance of CSOC procedures, standards, documentation, knowledge base articles and operational guidance • Prepare and present technical reports, summaries, findings and recommendations to internal and external stakeholders • Participate in a rotating on-call schedule to resolve critical system incidents when required

🎯 Requirements

• +5 years of relevant experience in the information technology field, including triage of alerts and supporting security incidents • Proven experience administering a SIEM platform, preferably Splunk or Microsoft Sentinel SIEM • Proven experience with SOC tools such as SIEMs and EDRs • Ability to autonomously perform technical analysis of security threats and collaborate with the Incident Response team • Deep knowledge of Microsoft Security Tools, including M365, Cloud App Security, Azure, Defender for Endpoints, Azure Security, Azure Sentinel and XDR • Deep knowledge of cloud technologies, including Azure, AWS and GCP • Deep knowledge of SIEM tools such as Splunk, QRadar, ArcSight, Microsoft Sentinel and ELK Stack • Knowledge of at least one EDR solution, such as Microsoft Defender for Endpoint or CrowdStrike • Knowledge of email security, network monitoring and incident response • Knowledge of Linux, Mac and Windows • C1 English proficiency • Mandatory participation in a rotating 24/7 on-call schedule, approximately one full week every X months • Experience building SIEM architectures from initial design to implementation (nice to have) • Proven knowledge of monitoring AWS environments (IaaS, SaaS, PaaS) (nice to have) • Knowledge of at least one general-purpose or shell scripting language such as Ruby, Bash, PowerShell or Python (nice to have) • Desirable certifications: MCSE, CCNA, Microsoft Azure SC-200, GCIH, CEH, GCFA or any GIAC/similar certification • Excellent communication skills • Customer-facing experience and oral communication skills • Ability to write documentation and reports • Creativity and ability to find innovative solutions • Willingness to learn on the job • Conflict management and cooperation

🏖️ Benefits

• Remote position • Freelance, full-time contract • Training and career development • Possibility to be part of a multicultural team • Work on international projects