Cybersecurity Analyst (SOC L2)

Description

Job Summary: We are seeking a Level 2 (L2) Security Analyst with solid experience in SIEM/SOAR solutions for our Security Operations Center (SOC). Key Responsibilities: 1. Analyze and investigate medium-to-high complexity security alerts 2. Design, implement, and optimize detection use cases using MITRE ATT&CK 3. Develop automation scripts (Python/PowerShell) - Devoteam is a leading European consultancy focused on digital strategy, technology platforms, cybersecurity, and technology-driven business transformation. Technology is in our DNA, and we believe in it as a lever capable of driving change to improve, maintaining a balance that allows us to offer our client portfolio top-tier technological tools—always accompanied by the proximity and professionalism of a team acting as a guide throughout the journey. Devoteam has been committed for over 25 years to technology serving people. With more than 10,000 professionals across 20 countries in Europe, the Middle East, and Africa. We are looking for a **Level 2 (L2) Security Analyst** for our Security Operations Center (SOC), with solid experience in SIEM/SOAR solutions—especially Google SecOps, CrowdStrike NG-SIEM, and Microsoft/AWS/GCP ecosystems. **PRIMARY RESPONSIBILITIES** **Detection and Response:** * Analyze and investigate medium-to-high complexity security alerts, aiming to resolve 80% without escalation to Level 3 (L3). * Perform root cause analysis on complex incidents, documenting findings and recommendations. * Coordinate incident responses involving multiple systems and cloud platforms. **Detection Engineering:** * Design, implement, and optimize detection use cases based on the **MITRE ATT&CK** framework. * Tune SIEM correlation rules and EDR/XDR detection policies to reduce false positives. * Validate and test new detections prior to production deployment. **Platforms and Tools:** * Operate and manage Google Chronicle SecOps, CrowdStrike Falcon Next-Gen SIEM, and Palo Alto XSIAM as primary platforms. * Manage detections in Microsoft 365 Defender, Azure Sentinel, and AWS Security Hub. * Use Palo Alto Cortex XSIAM for threat analysis and investigation. **Continuous Improvement:** * Develop automation scripts (Python/PowerShell) for repetitive tasks and alert enrichment. * Mentor and provide technical support to L1 analysts. * Contribute to technical documentation, *playbooks*, and operational procedures. * Participate in proactive threat hunting exercises. **TECHNICAL REQUIREMENTS** **Essential:** * **Fluent English (C1/C2 level)**: both written and verbal communication. * **2–4 years of experience** in SOC operations, with at least 1 year in an L2 role. * Practical experience with at least **two** of the following SIEM/SOAR platforms: Google Chronicle SecOps, Palo Alto XSIAM, CrowdStrike Falcon Next-Gen SIEM, or Microsoft Sentinel. * Demonstrable experience with **EDR/XDR** solutions (CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne, Cortex XDR, or Sophos). * Proficiency in query languages: **KQL (Kusto), SPL (Splunk), or SQL**. * Solid knowledge of networking and protocols: TCP/IP, DNS, HTTP/S, network traffic analysis. * Experience in Microsoft 365 environments (Exchange Online, Azure AD, Defender). **EMPLOYMENT CONDITIONS** * **Contract type:** Permanent, full-time. * **Work model:** Hybrid (Barcelona). * **On-call duties:** Rotating on-call availability (*on-call*). **Certifications (Optional but valued):** * Platform-specific certifications: SC-200, CrowdStrike Certified Falcon Administrator, or Google Chronicle Security Operations. * GIAC: GCIA, GCIH, or GCFA. * CompTIA Security+ or CySA+. * EC-Council Certified SOC Analyst (CSA). - English: C1-C2