Security Operations Center (SOC) Analyst

A company Cybersecurity organization is seeking a Security Operations Center (SOC) Analyst to provide front-line monitoring, investigation, and response across the firm's global environment. The role is intended for a technical professional with foundational cybersecurity knowledge and practical experience in security operations, IT operations, infrastructure support, networking, systems administration, or a related discipline.
The analyst will use enterprise security platforms and approved AI-assisted capabilities to assess threats, document findings, execute established response procedures, and escalate significant or ambiguous events. The position provides a development path into senior SOC analysis, incident response, threat hunting, detection engineering, and cybersecurity engineering.
Key Responsibilities
Security Monitoring & Investigation
Monitor and triage endpoint, identity, cloud, network, email, and application security alerts.
Correlate logs and evidence across multiple tools to determine scope, severity, and likely impact.
Independently investigate routine events and escalate significant or ambiguous activity with clear findings.
Maintain accurate case notes, timelines, evidence, and incident records.
Incident Response
Execute approved playbooks and support containment, remediation, recovery, and post-incident review activities.
Investigate phishing, credential misuse, malware, account takeover, privileged-access, and insider-risk scenarios.
Identify affected users, systems, identities, applications, and data sources.
Identity, Email, Endpoint & Cloud Security
Analyze suspicious authentication, Microsoft Entra ID, Active Directory, multi-factor authentication, and privileged-access activity.
Investigate user-reported phishing and coordinate remediation and follow-up.
Analyze endpoint detections and response alerts and security events across Microsoft 365, cloud, and SaaS platforms.
Automation & Continuous Improvement
Use approved AI-assisted tools to help investigate, summarize evidence, and improve analyst efficiency.
Create or modify basic PowerShell, Python, or similar scripts to reduce repetitive work.
Improve runbooks, knowledge articles, detections, and processes by identifying false positives and coverage gaps.
Required Qualifications
Bachelor's degree in Cybersecurity, Computer Science, Information Systems, Information Technology, Engineering, or a related field, or equivalent practical experience.
One to three years of relevant experience in a SOC, incident response, information security, NOC, systems administration, infrastructure operations, cloud operations, or Tier 2+ technical support role.
Experience with security monitoring, log analysis, alert triage, or a Security Information and Event Management (SIEM) platform.
Working knowledge of Microsoft 365, Microsoft Entra ID, Active Directory, Windows, basic Linux administration, and networking fundamentals including DNS, TCP/IP, VPN, and firewalls.
Understanding of common attack techniques, including phishing, credential theft, malware, privilege escalation, lateral movement, and account compromise.
Familiarity with the MITRE ATT&CK framework and basic PowerShell, Python, or comparable scripting.
Strong troubleshooting, analytical, documentation, organizational, and communication skills; able to remain effective during time-sensitive incidents.
Preferred Qualifications
Prior experience as a SOC or NOC analyst, system administrator, infrastructure engineer, Tier 2/3 support professional, or military cyber specialist.
Experience in financial services or another regulated industry.
Hands-on exposure to Microsoft Sentinel, Microsoft Defender XDR, CrowdStrike, Splunk, Proofpoint, SailPoint, Palo Alto Networks, Rapid7, or ServiceNow Security Operations.
Experience using approved large language model or AI-assisted tools for investigation, analysis, documentation, or automation.
Preferred Certifications
Strongly Preferred: CompTIA Security+; Microsoft SC-900: Security, Compliance, and Identity Fundamentals
Preferred: CompTIA CySA+; (ISC)² SSCP; GIAC GSEC or GCIH
Measures of Success
Independently investigates routine alerts and follows escalation standards.
Produces complete, concise, and defensible investigation records.
Demonstrates proficiency with the firm's primary security platforms and playbooks.
Contributes measurable improvements to runbooks, detections, automation, or analyst workflows.
Builds trusted working relationships with Cybersecurity, Infrastructure, and business stakeholders.
Location & Schedule:
Office: Kraków, Al. 29 Listopada 20 OR Warsaw Al. Jerozolimskie 181
Shift options:
– Thu – Mon, 10:30 – 18:30 CET
– Sat – Wed, 10:30 – 18:30 CET
Work from home is available on weekends; weekdays are office-based.
We're looking to hire several specialists to join the team — schedule is negotiable.
We are also considering candidates from other cities who are willing to move to Krakow (first priority) or Warsaw.