安全运营分析师（网络防御运营）
Security Operations Analyst (Cyber Defense Operations)
地点：西班牙瓦伦西亚，EMEA地区混合办公或远程
职位类型：全职合同
时长：6个月，可能延长
语言：需流利英语
行业：网络安全/云服务/企业安全
关于该职位
Pragmatike正在为一家大型国际组织招聘一名安全运营分析师，加入全球网络安全运营团队。
您将作为24/7安全运营中心（SOC）的一员，负责监控、检测、调查和响应企业、云、网络和终端环境中的网络威胁。
这是一项实践性很强的安全岗位，专注于警报分类、威胁调查、日志分析、事件响应和安全监控，与分布在多个地区的网络安全专家合作。
您的工作内容
- 在SIEM、EDR、微软安全工具和云平台中监控、分类并调查安全警报。
- 分析来自Windows、Linux、数据库、应用程序、Web服务器、防火墙和NIDS/HIDS的主机和网络日志。
- 调查可疑活动，确定根本原因，并采取适当的修复或升级措施。
- 支持事件响应、修复和恢复工作。
- 与事件响应和其他网络安全团队紧密合作，管理安全威胁。
- 使用TCP/IP、syslog、防火墙和网络监控数据分析网络和安全事件。
- 通过调整和优化，识别提升检测质量、减少误报的机会。
- 从客户处收集技术信息，以改进安全监控和检测。
- 准备并展示安全报告、摘要和技术发现。
- 参与SOC流程、文档、知识库和质量控制过程。
- 审查运营反馈并实施纠正措施，持续提升服务质量。
我们寻找的人选
- 5年以上IT/网络安全相关经验，包括安全警报分类和事件支持。
- 在SOC环境中工作的实际经验。
- 熟悉SIEM和EDR平台。
- 在Windows/Linux、数据库、应用程序和基础设施上具备高级日志分析能力。
- 精通微软安全技术，包括Microsoft Sentinel和Defender。
- 具有Azure、AWS和/或GCP上的云安全经验。
- 具有SIEM平台使用经验
查看英文原文
Location: Valencia, Spain, Hybrid OR Remote across EMEA
Employment: Full-Time Contract
Duration: 6 months, with potential extension
Language: Fluent English required
Industry: Cybersecurity / Cloud / Enterprise Security
ABOUT THE OPPORTUNITY
Pragmatike is recruiting on behalf of a major international organization for a Security Operations Analyst to join a global Cybersecurity Operations team.
You’ll be part of a 24/7 Security Operations Centre (SOC) responsible for monitoring, detecting, investigating, and responding to cyber threats across enterprise, cloud, network, and endpoint environments.
This is a hands-on security role focused on alert triage, threat investigation, log analysis, incident response, and security monitoring, working alongside cybersecurity specialists distributed across multiple regions.
WHAT YOU’LL DO
- Monitor, triage, and investigate security alerts across SIEM, EDR, Microsoft security tools, and cloud platforms.
- Analyze host and network logs from Windows, Linux, databases, applications, web servers, firewalls, and NIDS/HIDS.
- Investigate suspicious activity, identify root causes, and determine appropriate remediation or escalation.
- Support incident response, remediation, and recovery activities.
- Work closely with Incident Response and other cybersecurity teams to manage security threats.
- Analyze network and security events using TCP/IP, syslog, firewall, and network monitoring data.
- Identify opportunities to improve detection quality and reduce false positives through tuning and optimization.
- Gather technical information from clients to improve security monitoring and detection.
- Prepare and present security reports, summaries, and technical findings.
- Contribute to SOC procedures, documentation, knowledge bases, and quality-control processes.
- Review operational feedback and implement corrective actions to continuously improve service quality.
WHAT WE’RE LOOKING FOR
- 5+ years of relevant experience in IT/cybersecurity, including security alert triage and incident support.
- Hands-on experience working in a SOC environment.
- Strong experience with SIEM and EDR platforms.
- Advanced log analysis skills across Windows/Linux, databases, applications, and infrastructure.
- Strong knowledge of Microsoft Security technologies, including Microsoft Sentinel and Defender.
- Experience with cloud security across Azure, AWS, and/or GCP.
- Experience with SIEM platforms such as Splunk, QRadar, ArcSight, Microsoft Sentinel, or ELK.
- Experience with at least one EDR solution such as Microsoft Defender for Endpoint or CrowdStrike.
- Knowledge of email security, network monitoring, and incident response.
- Strong knowledge of Linux, macOS, and Windows.
- Fluent English with excellent written and verbal communication skills.
NICE TO HAVE
- Experience working on an Incident Response team with Tier-1/Tier-2 incident triage.
- AWS security monitoring experience across IaaS, PaaS, or SaaS environments.
- Scripting experience with Python, PowerShell, Bash, Ruby, or similar.
- Certifications such as Microsoft SC-200, GCIH, CEH, GCFA, GIAC, CCNA, or MCSE.
- Customer-facing cybersecurity experience.
WHY JOIN
- Work inside a global 24/7 cybersecurity operation protecting international organizations.
- Gain exposure to large-scale cloud, SIEM, EDR, network, and endpoint security environments.
- Collaborate with cybersecurity specialists across multiple regions and disciplines.
- Work directly on real-world threat detection and incident response.
- Build experience across a broad enterprise security technology stack.
Pragmatike is committed to a fair, transparent, and inclusive recruitment process. We do not discriminate based on age, disability, gender, gender identity or expression, marital or civil partner status, pregnancy or maternity, race, religion or belief, sex, or sexual orientation.
In accordance with GDPR, your personal data will be processed lawfully, fairly, and securely and used solely for recruitment purposes, including sharing it with our client(s) for employment consideration.