{"id":3940868,"url":"https://alion.io/job/ses-junior-analyst-security-operations","title":"Junior Analyst, Security Operations","company":{"id":54618,"name":"SES","domain":"ses.com","url":"https://alion.io/company/ses-com","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"SuccessFactors","truth_index":null},"role":"Security","role_family":"Security","seniority":"junior","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Bucharest, Romania"],"countries":["RO"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":1,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Linux","optional":false},{"name":"SIEM","optional":false},{"name":"Windows","optional":false},{"name":"MITRE ATT&CK","optional":true},{"name":"PowerShell","optional":true},{"name":"Python","optional":true}],"status":"live","first_seen_at":"2026-11-08T14:34:19Z","employer_posted_date":"2026-11-08","last_verified_at":"2026-11-08T14:34:19Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"Junior Analyst, Security Operations\nROLE DESCRIPTION SUMMARY\nThe Junior Analyst, Security Operations is responsible for monitoring security events and conducting end-to-end investigations of assigned security alerts and incidents, from initial detection and assessment through investigation, response coordination, validation, and documented closure.\nThe Junior Analyst correlates evidence across endpoint, identity, email, network, and cloud environments to determine whether activity is malicious, establish its scope and impact, and identify the actions required to address it. The analyst also performs authorized response actions and coordinates with relevant teams to ensure containment, remediation, and recovery activities are followed through.\nThe role requires sound analytical judgment, clear documentation, timely communication, and accountability for progressing investigations.\nPRIMARY RESPONSIBILITIES / KEY RESULT AREAS\nSecurity Monitoring and Prioritization\nMonitor and analyze security alerts and events from security platforms, user reports, and other relevant sources.\nAssess the credibility, urgency, and potential business impact of suspicious activity, prioritizing investigations according to established procedures.\nEnrich alerts with relevant asset, user, threat intelligence, and historical context.\nEnd-to-End Investigation\nOwn assigned investigations from initial assessment through to evidence-based closure, ensuring cases are actively progressed and outstanding actions are tracked.\nCorrelate logs, security telemetry, and other available evidence to reconstruct activity, distinguish legitimate behavior from threats, and identify affected users, systems, and services.\nInvestigate endpoint, identity, email, network, and cloud-related activity, using appropriate tools and documented investigation methods.\nAnalyze suspicious files, URLs, scripts, processes, and network connections using approved analysis tools and sandbox environments.\nEstablish the incident timeline, scope, impact, and likely attack path, identifying the initial access vector and root cause where evidence permits.\nClearly distinguish confirmed findings, working hypotheses, and evidence gaps, pursuing additional information where required.\nResponse, Remediation, and Closure\nPerform containment and response actions within delegated authority and approved procedures.\nCoordinate with IT, application owners, and other relevant teams to address affected accounts, endpoints, malicious artifacts, and identified security weaknesses.\nTrack containment, remediation, and recovery actions, following up on dependencies and escalating delays or unresolved risks.\nValidate the effectiveness of response actions using available evidence and confirm that closure criteria have been met.\nDocument the investigation outcome, supporting evidence, actions taken, and any remaining risks or follow-up requirements.\nEscalation and Collaboration\nEscalate incidents promptly when severity, complexity, business impact, or required actions exceed the analyst’s expertise or authority.\nProvide actionable escalation packages containing the investigation summary, evidence, timeline, scope, actions completed, outstanding questions, and support required.\nContinue progressing assigned investigative and coordination activities during escalation, unless case ownership is formally transferred.\nCollaborate with senior analysts and relevant stakeholders throughout the incident lifecycle.\nCase Documentation, Communication, and Handover\nMaintain accurate, timely, and traceable case records, including evidence sources, analysis, decisions, response actions, and stakeholder communications.\nProvide clear updates appropriate to the audience, highlighting material findings, risks, blockers, and next steps.\nDeliver structured shift handovers that identify case status, pending actions, ownership, priorities, and escalation requirements.\nHandle investigation evidence and sensitive information in accordance with applicable internal requirements.\nContinuous Improvement and Operational Quality\nIdentify recurring threats, detection gaps, false-positive patterns, and opportunities to improve investigation efficiency.\nContribute to playbooks, knowledge articles, detection tuning, and automation improvements based on investigation findings.\nApply relevant threat intelligence to active investigations and share actionable findings with the team.\nMeet established service levels and quality expectations, balancing response timeliness with investigation completeness, evidence quality, and effective resolution.\nParticipate in incident reviews, training, and operational readiness activities.\nCOMPETENCIES\nInvestigation ownership: Takes responsibility for progressing cases, following through on actions, and achieving defensible outcomes.\nAnalytical and critical thinking: Evaluates evidence objectively, tests hypotheses, and avoids unsupported conclusions.\nTechnical problem-solving: Uses available tools and information to investigate unfamiliar or ambiguous activity.\nJudgment and escalation: Recognizes when additional expertise, approval, or coordination is required and seeks support promptly.\nAttention to detail: Produces accurate case records, timelines, and handovers.\nCommunication: Explains technical findings clearly and provides concise, actionable updates.\nCollaboration: Works effectively with colleagues and stakeholders across functions and locations.\nPrioritization under pressure: Manages competing investigations while maintaining quality and appropriate urgency.\nLearning agility: Develops technical skills, incorporates feedback, and adapts to evolving threats and technologies.\nQUALIFICATIONS & EXPERIENCE\n Required \nBachelor’s degree in Cyber Security, Computer Science, Information Technology, or a related discipline, with 1-3 years of relevant experience; an equivalent combination of education, practical training, and experience will be considered.\nPractical understanding of security monitoring, incident investigation, and the incident response lifecycle.\nAbility to investigate security events, correlate evidence from multiple sources, and document clear findings and conclusions.\nFamiliarity with Security Information and Event Management (SIEM), Endpoint Detection and Response (EDR), and security case-management tools.\nFoundational knowledge of Windows and Linux, networking, authentication, identity security, and common attack techniques.\nAbility to interpret endpoint, authentication, email, and network logs.\nFoundational knowledge of suspicious file, URL, and script analysis, including extracting and assessing indicators of compromise using approved tools.\nUnderstanding of common threats, including phishing, malware, credential compromise, and unauthorized access.\nAbility to use search and query capabilities to retrieve and correlate investigation evidence.\nStrong written and verbal communication skills in English.\n\nPreferred / Nice to Have\nHands-on experience investigating security alerts and incidents in a SOC or similar environment.\nExperience with cloud and identity security investigations.\nFamiliarity with SOAR platforms, investigation playbooks, and response automation.\nScripting skills, such as PowerShell or Python, and experience with security query languages.\nExposure to malware analysis, digital forensics, and network traffic analysis.\nFamiliarity with threat intelligence and MITRE ATT&CK.\nRelevant certifications, such as CompTIA Security+, CompTIA CySA+, BTL1, or GCIH.\n\nOTHER KEY REQUIREMENTS / COMMENTS\nAvailability to work shifts.\nWillingness to undergo a NATO/EU SECRET security clearance procedure if required.\nEscalation provides additional expertise or decision-making authority; it does not replace investigation ownership unless responsibility is explicitly transferred.\nThe analyst also contributes to improving detection capabilities, investigation procedures, and operational readiness.\n\nSES and its Affiliated Companies are committed to providing fair and equal employment opportunities to all. We are an Equal Opportunity employer and will consider all qualified applicants for employment without regard to race, color, religion, gender, pregnancy, sex, sexual orientation, gender identity, national origin, age, genetic information, protected veteran status, disability, or any other basis protected by local, state, or federal law.\nFor more information on SES, click here.","description_format":"text","description_chars":8449,"description_truncated":false,"requirements":{"experience_years_min":1,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":true,"languages":[{"language":"English","level":"All levels","optional":false}]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Satellite Communications","Space Services"],"lifecycle":[{"event":"open","at":"2026-11-08T14:34:19Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":10,"reasons":["conf:1","win:early","comp:junior"],"computed_at":"2026-11-08T16:12:38Z"},"pay":null,"html_url":"https://alion.io/job/ses-junior-analyst-security-operations","json_url":"https://alion.io/job/ses-junior-analyst-security-operations.json","meta":{"generated_at":"2026-11-08T16:12:38Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":34244,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-09T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":54618},"rest":"https://alion.io/mcp/rest/get_company?id=54618"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fses-junior-analyst-security-operations"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":2,"usd":0.2},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fses-junior-analyst-security-operations"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fses-junior-analyst-security-operations"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/ses-junior-analyst-security-operations\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fses-junior-analyst-security-operations"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3940868}},{"tool":"search_jobs","arguments":{"company":"ses.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3940868},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}