Cyber Security Analyst

About the Role

We are looking for a Cyber Security Analyst to join our Security Operations team and contribute to the monitoring, investigation, and continuous improvement of our security environment.

Responsibilities:

• Monitor and respond to security alerts on a 24/7 basis, including participation in an on-call rotation.
• Perform initial alert triage and validation using logs, telemetry, and contextual information (Tier 1 analysis).
• Work directly with internal stakeholders and system owners to validate and investigate security events (Tier 2 analysis).
• Escalate confirmed or high-risk incidents to Tier 3 or Incident Response teams, providing detailed investigation findings.
• Develop, tune, and continuously improve detection rules, alert logic, and correlation use cases based on real-world threats and the MITRE ATT&CK Framework.
• Support and co-lead security investigations, including root-cause analysis, identification of lateral movement, and assessment of potential data exposure.
• Proactively identify emerging threats through threat hunting and purple teaming exercises.
• Contribute to the development and continuous improvement of SOC playbooks, investigation runbooks, and incident response procedures.
• Support the customization of security response strategies for the specific technical and organizational characteristics of SAP Cloud Infrastructure.
• Create and maintain security dashboards, metrics, and KPIs to measure SOC effectiveness and monitor threat landscape trends.
• Participate in lessons-learned reviews and provide recommendations to improve security detection and response processes.

Requirements:

• Bachelor's degree in Computer Science, Information Security, or a related technical field, or equivalent practical experience.
• 2-4 years of experience in a Security Operations Center (SOC) or cybersecurity operations role, preferably in cloud-based or hybrid environments.
• Solid understanding of cloud security principles and experience with Microsoft Azure, AWS, or GCP.
• Hands-on experience securing and monitoring workloads in public cloud environments.
• Strong knowledge of security logging, monitoring, and SIEM platforms, such as Splunk, ElasticSearch, OpenSearch, or Datadog.
• Experience with Threat Intelligence Platforms and security monitoring tools.
• Strong understanding of networking protocols, Linux systems, Kubernetes, container technologies, and common security controls.
• Familiarity with Docker and Kubernetes.
• Knowledge of the MITRE ATT&CK Framework, NIST incident handling lifecycle, and basic malware behavior.
• Hands-on experience with security alert triage, basic forensic analysis, and incident response support.
• Experience investigating cloud-native security events, such as IAM misconfigurations, insecure storage, compromised credentials, and unusual container behavior.
• Experience creating and maintaining detection rules and custom alerts.
• Experience using at least one SIEM platform and related log analysis tools.
• Familiarity with incident handling playbooks, security runbooks, and response procedures.
• Basic understanding of security practices related to Infrastructure as Code (IaC) and static code analysis tools.

Nice to Have:

• Experience working with SAP Cloud Infrastructure or other enterprise cloud environments.
• Experience improving SOC processes, detection capabilities, and incident response workflows.