安全运营分析师（SIEM 与威胁检测）
Security Operations Analyst (SIEM & Threat Detection)
地点：西班牙瓦伦西亚，混合办公或跨 EMEA 远程办公
雇佣类型：全职合同
时长：6个月，可能延长
语言：需流利英语
行业：网络安全 / SIEM / 云安全
关于该职位
Pragmatike 正在为一家大型国际组织招聘一名专注于 SIEM 和威胁检测的安全运营分析师。
你将加入一个全球网络安全运营团队，专注于构建、运营并持续改进保护国际组织及其技术环境的安全监控能力。
与传统的 SOC 监控角色不同，该职位重点在于 SIEM 管理、检测工程、安全内容、数据源接入、用例生命周期管理以及检测优化。
你将与威胁情报、事件响应和网络安全运营团队紧密合作，将安全需求和新兴威胁转化为有效的、可衡量的检测能力。
你将负责
- 开发、实施、验证、调优并维护安全监控和检测能力。
- 在多个客户环境中管理并优化 SIEM 平台。
- 管理安全检测规则和用例在其整个生命周期中。
- 接入、集成、测试并验证新的安全数据源和遥测数据流。
- 审查并改进检测逻辑、安全内容和监控配置。
- 与威胁情报和事件响应团队合作，将威胁转化为可操作的检测能力。
- 支持网络安全架构评审，并提供改进建议以提升安全监控。
- 构建并维护安全指标、仪表盘、KPI 和绩效报告。
- 评估检测效果，识别减少误报的机会。
- 参与质量保证、流程审查、控制验证和纠正措施。
- 维护 SOC 流程、标准、文档、知识库和操作指南。
- 准备技术报告、发现和建议，供内部和外部利益相关者使用。
我们寻找
- 5年以上相关 IT/网络安全经验。
- 有实际操作 SIEM 平台的经验，最好是 Splunk 或 Microsoft Sentinel。
- 在 SIEM/EDR 环境和技术安全分析方面有丰富经验。
- 深入了解
查看英文原文
Location: Valencia, Spain, Hybrid OR Remote across EMEA
Employment: Full-Time Contract
Duration: 6 months, with potential extension
Language: Fluent English required
Industry: Cybersecurity / SIEM / Cloud Security
ABOUT THE OPPORTUNITY
Pragmatike is recruiting on behalf of a major international organization for a Security Operations Analyst specializing in SIEM and Threat Detection.
You’ll join a global Cybersecurity Operations team focused on building, operating, and continuously improving the security monitoring capabilities protecting international organizations and their technology environments.
Unlike a traditional SOC monitoring role, this position has a strong focus on SIEM administration, detection engineering, security content, data-source onboarding, use-case lifecycle management, and detection optimization.
You’ll work closely with Threat Intelligence, Incident Response, and Cybersecurity Operations teams to turn security requirements and emerging threats into effective, measurable detection capabilities.
WHAT YOU’LL DO
- Develop, implement, validate, tune, and maintain security monitoring and detection capabilities.
- Administer and optimize SIEM platforms across multiple customer environments.
- Manage security detection rules and use cases throughout their lifecycle.
- Onboard, integrate, test, and validate new security data sources and telemetry feeds.
- Review and improve detection logic, security content, and monitoring configurations.
- Collaborate with Threat Intelligence and Incident Response teams to translate threats into actionable detection capabilities.
- Support cybersecurity architecture reviews and provide recommendations to improve security monitoring.
- Build and maintain security metrics, dashboards, KPIs, and service-performance reports.
- Evaluate detection effectiveness and identify opportunities to reduce false positives.
- Contribute to quality assurance, process reviews, control validation, and corrective actions.
- Maintain SOC procedures, standards, documentation, knowledge bases, and operational guidance.
- Prepare technical reports, findings, and recommendations for internal and external stakeholders.
WHAT WE’RE LOOKING FOR
- 5+ years of relevant IT/cybersecurity experience.
- Proven hands-on experience administering a SIEM platform, ideally Splunk or Microsoft Sentinel.
- Strong experience with SIEM/EDR environments and technical security analysis.
- Deep knowledge of Microsoft Security technologies.
- Strong cloud security knowledge across Azure, AWS, and/or GCP.
- Experience with platforms such as Splunk, QRadar, ArcSight, Microsoft Sentinel, or ELK.
- Experience with at least one EDR platform such as Microsoft Defender for Endpoint or CrowdStrike.
- Knowledge of email security, network monitoring, and incident response.
- Strong Linux, macOS, and Windows knowledge.
- Fluent English with excellent written and verbal communication skills.
NICE TO HAVE
- Experience designing SIEM architecture from initial design through implementation.
- Experience building data-ingestion pipelines for diverse cloud and on-premise log sources.
- AWS security monitoring experience.
- Scripting experience with Python, PowerShell, Bash, Ruby, or similar.
- Security certifications such as SC-200, GCIH, CEH, GCFA, GIAC, CCNA, or MCSE.
- Experience working across multiple customer environments.
WHY JOIN
- Work beyond traditional SOC monitoring and contribute to the engineering and optimization of security detection capabilities.
- Gain exposure to large-scale SIEM, EDR, cloud, and threat-detection environments.
- Work directly with Threat Intelligence, Incident Response, and Cybersecurity Operations teams.
- Help shape detection use cases, monitoring architecture, and operational processes.
- Work on cybersecurity services supporting multiple international organizations.
Pragmatike is committed to a fair, transparent, and inclusive recruitment process. We do not discriminate based on age, disability, gender, gender identity or expression, marital or civil partner status, pregnancy or maternity, race, religion or belief, sex, or sexual orientation.
In accordance with GDPR, your personal data will be processed lawfully, fairly, and securely and used solely for recruitment purposes, including sharing it with our client(s) for employment consideration.