Security Operations Analyst – SIEM Operations, Threat Detection

Job not on LinkedIn

🔥 1 minute ago

🇪🇸 Spain – Remote

⏰ Full Time

🟡 Mid-level

🟠 Senior

🛡️ Security Operations

👻 Ghost score 11%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

Talan

WebsiteLinkedInAll Job Openings

1001 - 5000 employees

Founded 2003

💼 Consulting

🏢 Enterprise

☁️ SaaS

💰 Secondary Market on 2020-07

Consulting • Enterprise • SaaS

Talan is a global company specializing in supporting organizations through positive innovation and transformation. With a presence in 18 countries across 5 continents, Talan offers a diverse range of solutions that enhance decision-making, integrate technology into business strategies, and reinvent business models for resilience and operational excellence. Talan excels in data management and governance, AI-powered solutions, cybersecurity, and cloud platforms. By partnering with leading technology providers like Microsoft, SAP, Oracle, and Salesforce, Talan aims to democratize data use and drive low-carbon transitions. The company also focuses on industries such as energy, transport, financial services, and more, providing insights and solutions tailored to the specific needs of these sectors.

📋 Description

• Enhance threat detection and cybersecurity operations capabilities within the Cyber Security Operations Center • Develop, implement, validate, tune and maintain security monitoring, analytics and detection capabilities across SIEM, EDR, cloud and other cybersecurity platforms • Operate, maintain, optimize and continuously improve security monitoring and threat detection services • Onboard, integrate, test and validate security data sources, telemetry feeds and monitoring capabilities • Manage security content, including detection use-case lifecycles, rule reviews, testing, tuning and content quality assurance • Collaborate with cyber threat intelligence, incident response and cybersecurity operations teams to translate requirements into detection and monitoring capabilities • Participate in cybersecurity architecture reviews and provide recommendations to improve monitoring and detection effectiveness • Prepare and maintain cybersecurity operations metrics, dashboards, KPIs and service performance reports • Review and assess detections, monitoring configurations, operational processes and service deliverables, identifying improvement opportunities • Analyze operational feedback to optimize tuning, reduce false positives and improve detection quality • Contribute to quality assurance, process reviews, control validation, service quality assessments and corrective actions • Maintain CSOC procedures, standards, documentation, knowledge-base articles and operational guidance • Prepare and present technical reports, summaries, findings and recommendations to internal and external stakeholders • Participate in the mandatory rotating on-call schedule to resolve critical incidents when required

🎯 Requirements

• Mandatory participation in a rotating 24/7 on-call shift schedule from Monday to Sunday; approximately one full week every X months depending on team size • 5+ years of relevant experience in information technology, including alert triage and security incident support • Proven experience administering a SIEM platform, preferably Splunk or Microsoft Sentinel SIEM • Proven experience with SOC tools such as SIEMs and EDRs; ability to independently perform technical analysis of security threats and collaborate with the Incident Response team • Deep knowledge of Microsoft Security Tools, including M365, Cloud App Security, Azure, Defender for Endpoint, Azure Security, Azure Sentinel and XDR • Deep knowledge of cloud technologies such as Azure, AWS and GCP • Deep knowledge of SIEM tools such as Splunk, QRadar, ArcSight, MS Sentinel and ELK Stack • Knowledge of at least one EDR solution, such as MS Defender for Endpoint or CrowdStrike • Knowledge of email security, network monitoring and incident response • Knowledge of Linux, Mac and Windows • C1 English proficiency • Experience building SIEM architectures from initial design to implementation, including data ingestion pipelines for diverse cloud and on-premises log sources • Proven knowledge monitoring AWS environments (IaaS, SaaS, PaaS) • Knowledge of at least one general-purpose or shell scripting language, such as Ruby, Bash, PowerShell or Python • Desirable certifications include MCSE, CCNA, Microsoft Azure SC-200, GCIH, CEH, GCFA or any GIAC/similar certification • Excellent communication skills • Customer-facing and oral communication experience • Ability to write documentation and reports • Creativity and ability to find innovative solutions • Willingness to learn on the job • Conflict management and cooperation

🏖️ Benefits

• Remote position • Freelance, full-time contract • Training and career development • Possibility to be part of a multicultural team and work on international projects