Cybersecurity Analyst

Job Description

Source is an ecosystem of independent technology companies behind responsible access to web data. Source works behind the scenes, providing shared standards and dedicated support that help each company grow. The culture follows the same idea: colleagues work across the ecosystem, share what they know, and hold a high bar, so a good idea in one place can create an advantage everywhere.

The security team is responsible for safeguarding our infrastructure and applications against an ever-evolving landscape of cyber threats. As a Cybersecurity Analyst, you will be on the front lines of our operations, actively managing our SIEM environments and leading incident response efforts. With our data ecosystem rapidly expanding, scaling our security monitoring and automated detection capabilities is more timely and critical than ever. Your work here directly ensures the integrity of our complex data operations, keeping our products secure and our global customers protected.

In this role, you will:

• Monitor, triage, and investigate alerts from the SIEM (Wazuh/Elasticsearch) and other security tools, separating true positives from noise.
• Run incident response steps: containment, evidence collection, root cause analysis, and remediation follow-up.
• Build, tune, and maintain detection rules and decoders for various attack scenarios in Wazuh and Elasticsearch.
• Onboard and normalize new log sources to expand our visibility.
• Continuously improve SOC operations by identifying gaps in detection logic, playbooks, and triage workflows.
• Help assess and validate external pentest and bug bounty reports.

Requirements

• 2-4 years of experience working in security operations, incident response, or application security.
• Experience with SIEM platforms (Wazuh, Elastic/ELK, Splunk, or similar), including writing queries and detection rules.
• Scripting skills (Python, Bash, or similar) for automation, log parsing, and building testing tools.
• Strong understanding of web technologies and how they are attacked, including HTTP/S, session management, authentication protocols (OAuth 2.0, OIDC, JWT), REST and GraphQL APIs, and browser security controls (SOP, CORS, CSP).
• Knowledge and practical experience of OWASP Top 10 exploitation.

Nice to have

• Certifications such as OSCP, OSWE, BSCP (Burp Suite Certified Practitioner), eWPT/eWPTX, GWAPT, GCIH, or CySA+.
• Experience with WAFs, bot management, or anti-abuse systems (Cloudflare, Akamai, AWS WAF, or similar).
• Experience with cloud environments (AWS, GCP, Azure) and containerized apps (Docker, Kubernetes).
• Familiarity with Elastic Fleet/Agent and Wazuh rule and decoder development.

Company offers

• Growth & Learning: 40+ internal learning options, external conferences, mentorship, and year-round knowledge-sharing.
• Health & Well-being: Private health insurance, psychotherapy, on-site well-being consultants, 24/7 gym access, and a wellness app.
• Celebration & Community: Team events, an overseas workation, quarterly team-building budgets, and plenty of ways to mark milestones together.
• Bonus vacation days, paid life-moment days off, barista coffee, and all the tools you need.
• Cyber City office perks
• Hybrid work (3 office days / 2 WFH) & WFA options
• Latest tools, gadgets & tech stack
• Extra day off
• Inclusive family-related time-off policy
• 24/7 gym
• Physical well-being specialists
• Psychologist/psychotherapist sessions
• Vast internal & external learning resources
• Guilds, communities & 800+ professionals by your side
• Source network & knowledge sharing
• Yearly workation
• Year-round internal & Source community events
• Team building budget