{"id":2128297,"url":"https://alion.io/job/grant-thornton-security-operations-center-soc-analyst","title":"Security Operations Center (SOC) Analyst","company":{"id":1838477,"name":"Grant Thornton Poland","domain":"grantthornton.pl","url":"https://alion.io/company/grantthornton-pl","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":null,"truth_index":null},"role":"Security","role_family":"Security","seniority":"junior","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Poznań, Poland"],"countries":["PL"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":9000,"max":12900,"currency":"PLN","period":"month","gross":null,"usd_annual":39600},"salary_estimate":null,"experience_years_min":2,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Crowdstrike","optional":false},{"name":"IAM","optional":false},{"name":"Incident Management","optional":false},{"name":"ITSM","optional":false},{"name":"Platform Engineering","optional":false},{"name":"ServiceNow","optional":false},{"name":"SIEM","optional":false}],"status":"live","first_seen_at":"2026-10-01T07:48:38Z","employer_posted_date":null,"last_verified_at":"2026-10-01T07:48:38Z","board_verified":false,"closed_at":null,"days_open":18,"trust":{"level":"not_scored","repost_count":null,"flags":[],"days_open":18},"description":"Security Monitoring & Alert Triage\nUse CrowdStrike Falcon Next-Gen SIEM as the primary platform for real-time monitoring, query-based analysis, detection review, event correlation, case management, and reporting.\nReview, prioritize, and classify alerts using the established severity matrix and SOC operating procedures.\nDetermine whether alerts represent false positives, benign activity, suspicious activity, policy violations, or potential security incidents.\nConduct triage, detailed investigation, evidence review, response coordination, and closure documentation for assigned alerts and incidents.\nAnalyze and interpret first-party detections, third-party detections, and correlation rule outputs.\nMaintain accurate triage decisions, evidence notes, and investigation updates in the incident management platform.\nIncident Response & Remediation\nEnsure incidents are handled promptly in line with SOC runbooks, escalation workflows, and operational expectations.\nExecute approved Cybersecurity Incident Response Plan activities and associated SOC playbooks.\nSupport containment, eradication, and recovery activities in coordination with IT resolver teams, platform engineering, IAM, network security, email security, and infrastructure teams.\nEscalate confirmed major incidents to CSIRT or management stakeholders when escalation criteria are met.\nAssist with root cause analysis documentation for major incidents, repeat incidents, or incidents requiring formal review.\nThreat Analysis & Continuous Improvement\nSupport threat hunting, detection validation, and investigation workflows using Falcon Next-Gen SIEM.\nIdentify vulnerabilities, suspicious activity, threats, exploits, and weaknesses in security controls.\nCreate visualizations, summaries, and investigation reports to communicate event details to SOC leadership and operational stakeholders.\nRecommend improvements to detection logic, correlation rules, dashboards, alert handling procedures, and SOC runbooks.\nReview internal and external threat intelligence advisories, indicators of compromise, and relevant adversary activity.\nSupport SOC metrics, quality checks, reporting, and continuous improvement initiatives.\nSupport audit, compliance, and evidence requests as required.\nShift & Operational Requirements\nOperate within 24x7 security operations and incident response environment.\nWork within a tierless SOC where each analyst may handle triage, investigation, response coordination, documentation, escalation, and closure activities.\nCommunicate clearly with technical teams, business stakeholders, management, and, where relevant, legal/privacy and communications teams.\nFollow structured incident response, evidence handling, reporting, and documentation practices.\nWhat we offer:Hybrid working model (2 days in the office and 3 days working remotely)\nStable employment with an employment contract, private medical care, and a benefits package including MultiSport and a benefits platform\nOpportunity to work in an international environment and collaborate with experienced Grant Thornton experts and professionals from around the world\nA culture based on teamwork, trust, and knowledge sharing\nA well-structured onboarding program to support a smooth start and successful integration into your new role\nClear career development paths and access to learning and certification programs\nAccess to training platforms and tools that support professional growth\nAn inclusive workplace that welcomes people with disabilities\nA modern office in Poznań, located in Malta Office Park\nFluency in Polish and English\nWymagania\nExperience:\n2+ years of experience in security operations, SOC monitoring, SIEM operations, EDR, MDR, incident response, information security, or a related cybersecurity role.\nExperience working in a SOC, MDR, MSSP, enterprise security operations, or similar operational environment.\nHands-on experience with CrowdStrike Falcon Next-Gen SIEM / EDR strongly preferred.\nExperience with ServiceNow or a similar ITSM/security case management platform.\nEducation:\nBachelor’s degree in computer science, Information Security, Cybersecurity, or a related discipline preferred.\nEquivalent practical experience in cybersecurity operations, incident response, threat hunting, or digital forensics will also be considered.\nCertifications (Preferred)\nCrowdStrike Certified SIEM Analyst (CCSA)\nCompTIA CySA+\nOther SOC, SIEM, incident response, network security, or digital forensics certifications\nCore Competencies:\nStrong hands-on information security skills\nStrong incident investigation and analytical reasoning skills\nOwnership mindset with strong attention to detail\nSolid understanding of MITRE ATT&CK and the incident response lifecycle\nExcellent written and verbal communication skills\nAbility to brief both technical and non-technical stakeholders\nStrong organization, time management, and attention to detail\nCalm, structured decision-making under high-pressure incidents\nAbility to work independently and as part of a team\nWe are looking for a technically strong, motivated SOC Analyst to join a follow-the-sun security operations team. This is a hands-on role covering continuous monitoring, alert triage, incident investigation, threat analysis, incident response support, remediation coordination, documentation, and ongoing improvement of detection and response capability.\nWe operate a tierless SOC model — analysts own the full security operations lifecycle, from initial alert review and triage through investigation, containment support, escalation, documentation, closure, and improvement recommendations.\nThe primary platform is CrowdStrike Falcon Next-Gen SIEM. Analysts should be comfortable querying and analyzing security data, interpreting detections, correlating events across data sources, assessing suspicious or malicious activity, contributing to investigations, using dashboards and case management tools, and producing clear reporting.\nTech stack\nSecurity\nEDR\nCybersecurity\nDegree","description_format":"text","description_chars":5994,"description_truncated":false,"requirements":{"experience_years_min":2,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Hybrid work"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","Security Operations","Commerce","Cybersecurity"],"lifecycle":[{"event":"open","at":"2026-10-09T00:39:00Z"}],"visa":[],"liveness":{"score":47,"band":"ok","label":"Likely open","p_open":0.85,"p_active":0.743,"p_room":0.75,"age_days":17,"expected_fill_days":19,"reasons":["seen:17","velocity","win:late","comp:junior"],"computed_at":"2026-10-19T05:45:15Z"},"pay":{"stated_usd_annual":39600,"is_top_pay":false},"html_url":"https://alion.io/job/grant-thornton-security-operations-center-soc-analyst","json_url":"https://alion.io/job/grant-thornton-security-operations-center-soc-analyst.json","meta":{"generated_at":"2026-10-19T22:47:45Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":1746,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-20T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1838477},"rest":"https://alion.io/mcp/rest/get_company?id=1838477"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fgrant-thornton-security-operations-center-soc-analyst"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fgrant-thornton-security-operations-center-soc-analyst"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fgrant-thornton-security-operations-center-soc-analyst"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/grant-thornton-security-operations-center-soc-analyst\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fgrant-thornton-security-operations-center-soc-analyst"}]}