Security Operations Analyst (L1/L2)
L1 Security Operations Analyst at fintech firm JustMarkets Tech, monitoring and triaging security alerts day to day — validating, enriching and documenting cases in a SIEM/EDR stack, closing false positives via runbooks, and escalating real incidents to L2/IR. Remote role based in Europe.
- Compensation
- Not disclosed
- Location
- Europe
- Work setup
- Remote
- Seniority
- Junior
- Employment
- Full time
- Experience
- 1+ years
- Category
- Security
- Posted
Skills
Must have
- Hands-on experience with security alert triage (work, internship, or lab), including at least one SIEM and exposure to EDR/XDR and case-management workflows
- Ability to build basic searches/queries and correlate activity across multiple data sources (basic SIEM query languages such as KQL, EQL)
- Ability to interpret endpoint, identity, authentication, network, DNS, HTTP, and service/cloud audit telemetry at initial-investigation level
- Working fundamentals of Windows and Linux, TCP/IP, DNS, HTTP, authentication, access control, and common attack patterns
- Ability to distinguish true/false positives and benign activity, assign preliminary severity, and identify affected users or assets
- Basic use of IOCs, reputation sources, and threat-intelligence context; awareness of MITRE ATT&CK
- Ability to create concise investigation timelines and document evidence and handover notes in a case-management system
- Ability to follow approved runbooks, stay within L1 authority, and escalate suspected incidents correctly
Nice to have
- Simple Python or PowerShell scripts for investigation and enrichment
- Exposure to cloud, email-security, or SaaS audit logs and phishing-investigation workflows
- Practical cybersecurity labs or entry-level certification such as Security+ or CySA+
- Experience with MacOS
Full description
We are inviting you, a highly motivated and results-oriented Security Operations Analyst to join our team on a full-time basis.
Our team has unique expertise in research, analysis, and product development. By relying on technical insights and a data-driven approach, we create disruptive future-defining innovations of the fin-tech industry that remain our basis for success.
Responsibilities
Monitor prioritized alert queues and validate whether alerts indicate real risk
Enrich cases and correlate relevant endpoint, identity, authentication, network, service, asset, user, timeline, and business context
Perform initial investigations, classify alerts, assess preliminary severity and scope, and document the evidence and reasoning in the case-management system
Close false positives and execute approved low-risk actions only through defined runbooks
Escalate suspected incidents, privileged-account issues, and high-impact or production-impact cases to L2, the manager, or Incident Response
Maintain clear handover notes and support improvements to case quality and runbooks
Requirements
At least 1+ year hands-on experience with security alert triage through work, including use of at least one SIEM and exposure to EDR or XDR and case-management workflows
Ability to build basic searches or queries, filter security events, and correlate related activity across more than one data source (Experience with basic SIEM query languages such as KQL, EQL)
Ability to interpret common endpoint, identity, authentication, network, DNS, HTTP, and service or cloud audit telemetry at an initial-investigation level
Working fundamentals of Windows and Linux, TCP/IP, DNS, HTTP, authentication, access control, and common attack patterns such as phishing, credential abuse, malware execution, and suspicious account activity
Ability to distinguish true positives, false positives, and benign activity; assign a preliminary severity; identify affected users or assets; and recognize when scope or impact is uncertain
Basic use of indicators of compromise, reputation sources, and threat-intelligence context, with awareness of the MITRE ATT&CK framework
Ability to create a concise investigation timeline and document evidence, actions, conclusions, and handover or escalation notes in a case-management system
Will be a plus
Simple Python or PowerShell scripts for investigation and enrichment
Exposure to cloud, email-security, or SaaS audit logs and common phishing-investigation workflows
Practical cybersecurity labs or an entry-level certification such as Security+ or CySA+
Experience with MacOS