Security Operations Analyst (L1/L2) (Cybersecurity)

Location: Europe; remote work opportunity available

Company

hirify.global operates in the financial services sector.

What you will do

• Monitor prioritized alert queues and validate whether alerts indicate real security risk.
• Enrich cases and correlate endpoint, identity, authentication, network, service, asset, user, timeline, and business context.
• Conduct initial investigations, classify alerts, assess preliminary severity and scope, and document evidence and reasoning in the case-management system.
• Close false positives and execute approved low-risk actions through defined runbooks.
• Escalate suspected incidents, privileged-account issues, and high-impact or production-impact cases to L2, the manager, or Incident Response.
• Maintain clear handover notes and support improvements to case quality and runbooks.

Requirements

• At least 1+ year of hands-on experience with security alert triage through work, including use of at least one SIEM, exposure to EDR or XDR, and case-management workflows.
• Ability to build basic searches or queries, filter security events, and correlate related activity across multiple data sources, including basic SIEM query languages such as KQL and EQL.
• Ability to interpret common endpoint, identity, authentication, network, DNS, HTTP, and service or cloud audit telemetry at an initial-investigation level.
• Working fundamentals of Windows, Linux, TCP/IP, DNS, HTTP, authentication, access control, and common attack patterns including phishing, credential abuse, malware execution, and suspicious account activity.
• Ability to distinguish true positives, false positives, and benign activity; assign preliminary severity; identify affected users or assets; and recognize uncertain scope or impact.
• Basic use of indicators of compromise, reputation sources, and threat-intelligence context, with awareness of the MITRE ATT&CK framework.
• Ability to create concise investigation timelines and document evidence, actions, conclusions, and handover or escalation notes in a case-management system.

Nice to have

• Simple Python or PowerShell scripts for investigation and enrichment.
• Exposure to cloud, email-security, or SaaS audit logs and common phishing-investigation workflows.
• Practical cybersecurity labs or an entry-level certification such as Security+ or CySA+.
• Experience with macOS.

Culture & Benefits

• Opportunity to work remotely from Europe.
• 20 paid vacation days per year.
• 10 paid sick leave days per year.
• Public holidays according to the approved company holiday list.
• Medical, professional education, language learning, and wellness budgets.