Cybersecurity SOC Analyst

• Monitor, triage, and investigate security alerts in Rapid7 InsightIDR
• Correlate logs from firewalls, endpoints, and other devices
• Help mitigate verified security incidents
• Write and tune detection rules across multiple data sources
• Use SentinelOne endpoint detection and response signals
• Identify opportunities to automate triage and reduce manual effort
• Review Cyberhaven DLP events for inappropriate movement of client or company data
• Investigate transfers to personal email or AI platforms
• Follow up with colleagues and managers regarding flagged activity
• Distinguish suspicious behavior from expected activity using knowledge of protected technology
• Track emerging threats, malware, and cloud vulnerabilities
• Contribute findings to incident response playbooks and detection improvements
• Support Kognitiv globally with European time-zone coverage
• Report to Ousmane Ndiaye and collaborate on day-to-day security operations

• Hands-on SOC analyst experience investigating alerts and working with SIEM platforms
• Typically 2–4 years of experience; not an entry-level role
• Practical experience with Rapid7, Splunk, Microsoft Sentinel, or another SIEM
• Experience working with DLP tools and investigating potential data loss or inappropriate data transfers
• Querying, scripting, or programming skills applicable to security analysis and detection rules
• Experience with LEQL, KQL, SPL, or Python is relevant
• Broad understanding of IT systems, network protocols, and cloud architectures
• Relevant technical degree or equivalent industry experience
• Practical experience with endpoint detection and response (EDR) tools
• Methodical approach to active investigations and careful attention to log data, network traffic, and indicators of compromise
• Curiosity and willingness to keep learning as threats, vulnerabilities, and attacker tactics evolve
• Visa sponsorship is not available
• Must have work authorization in the employing country that does not require current or future visa sponsorship
• Nice to have: Experience with Rapid7, Cyberhaven, or SentinelOne
• Nice to have: Familiarity with MITRE ATT&CK or CIS Controls
• Nice to have: Security+, CySA+, relevant Splunk security certification, or Rapid7 InsightIDR Certified Specialist
• Nice to have: SIEM engineering or log-platform configuration experience

• Remote work arrangement
• Regular working hours in the employee’s local time zone
• Occasional later meetings for cross-region collaboration