Company Overview

The organisation maintains a security-focused technology environment designed to detect, investigate, and respond to threats affecting its information systems and digital operations. Its security operations function supports continuous visibility into system activity, evaluates security alerts, and coordinates incident handling to reduce the likelihood and impact of cyberattacks.

The team combines security monitoring technologies, established investigation procedures, threat intelligence, and collaboration with IT and infrastructure specialists. Its approach emphasises timely alert triage, accurate documentation, effective escalation, and ongoing improvement of detection capabilities.

Role Summary

The SOC Analyst will monitor security events, investigate alerts, identify suspicious activity, and support the response to potential cybersecurity incidents. The role focuses on analysing telemetry from endpoints, servers, identity systems, network devices, and cloud environments to determine whether observed activity represents a genuine threat or a benign event.

The successful candidate will apply structured investigation techniques to prioritise alerts, establish the scope of suspicious activity, and escalate confirmed or high-risk incidents to the appropriate security personnel. The analyst will also contribute to detection-rule improvement, incident documentation, threat intelligence analysis, and the refinement of security monitoring procedures.

This position is suited to a security professional with strong analytical skills, an interest in threat detection, and the ability to work methodically under time-sensitive conditions. The candidate must be comfortable documenting findings, following established response procedures, and communicating clearly with technical teams during investigations.

Key Responsibilities

• Monitor security alerts and events generated by SIEM platforms, endpoint detection tools, identity systems, firewalls, and cloud security services.
• Triage incoming alerts according to severity, potential business impact, indicators of compromise, and established escalation procedures.
• Investigate suspicious authentication attempts, unusual account activity, endpoint alerts, malicious files, and potentially unauthorised network connections.
• Correlate events from multiple log sources to determine whether suspicious activity represents a genuine security incident.
• Analyse timestamps, source addresses, account activity, process execution records, and other relevant telemetry to reconstruct event sequences.
• Identify potential phishing incidents, credential compromise, malware activity, suspicious scripts, and other common attack patterns.
• Perform initial incident scoping and gather relevant evidence while following approved procedures for data handling and preservation.
• Escalate confirmed or high-risk incidents to senior security personnel and support containment, remediation, and recovery activities.
• Maintain accurate case records documenting alert details, investigation steps, evidence, conclusions, and recommended next actions.
• Review threat intelligence feeds and assess relevant indicators against available security telemetry.
• Assist with the development, testing, and refinement of SIEM correlation rules, alert thresholds, and detection logic.
• Identify repetitive false positives and recommend improvements that reduce alert fatigue without weakening meaningful threat detection.
• Support endpoint isolation, account restrictions, indicator blocking, and other approved containment measures when authorised.
• Review security incidents after resolution to identify missed detection opportunities and recommend process improvements.
• Contribute to incident response playbooks, operational procedures, escalation matrices, and investigation checklists.
• Work with IT operations and infrastructure teams to resolve security findings and verify that corrective measures have been implemented.
• Monitor security dashboards and operational metrics, including alert volumes, investigation queues, response times, and recurring incident categories.
• Support vulnerability-related investigations by identifying signs of exploitation or suspicious activity involving exposed systems.
• Participate in security knowledge-sharing sessions and keep current with common attack techniques and defensive investigation methods.
• Maintain confidentiality and follow established policies for access to sensitive logs, security records, and incident information.

Requirements and Qualifications

• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, or a related field, or equivalent practical experience.
• At least two years of experience in a SOC, security operations, IT security, incident monitoring, or a closely related technical role.
• Understanding of security monitoring, event correlation, alert triage, and common incident response procedures.
• Familiarity with SIEM platforms such as Microsoft Sentinel, Splunk, IBM QRadar, or comparable tools.
• Knowledge of endpoint detection and response solutions and common endpoint security events.
• Understanding of TCP/IP, DNS, HTTP/S, VPNs, firewalls, and basic network traffic analysis.
• Familiarity with Windows and Linux operating systems, authentication events, system logs, and endpoint telemetry.
• Ability to recognise common indicators of compromise and investigate potentially malicious activity.
• Understanding of phishing, malware, brute-force attempts, suspicious sign-ins, privilege abuse, and credential theft.
• Familiarity with the MITRE ATT&CK framework or comparable threat classification approaches.
• Basic scripting skills in Python, PowerShell, or Bash are an advantage.
• Knowledge of incident documentation, evidence handling, ticketing systems, and escalation procedures.
• Ability to distinguish routine operational activity from behaviour that warrants further investigation.
• Strong attention to detail, logical reasoning, and the ability to communicate findings clearly.
• Willingness to follow documented processes and maintain consistent investigation standards.
• Relevant certifications such as CompTIA Security+, Microsoft security certifications, or GIAC entry-level credentials are advantageous.
• Professional English proficiency and the ability to collaborate with a distributed security team.

Technical Environment

The role may involve SIEM platforms, EDR tools, threat intelligence sources, log-management systems, endpoint protection, firewall monitoring, identity security services, and incident tracking platforms. The analyst may also work with packet-analysis tools, security dashboards, scripting utilities, and detection frameworks.

Benefits

• Remote working opportunity within Estonia.
• Full-time, permanent employment arrangement.
• Practical exposure to security monitoring, incident investigation, and threat detection.
• Opportunities to strengthen skills in SIEM analysis, endpoint security, and incident response.
• Collaboration with experienced cybersecurity and infrastructure professionals.
• Opportunities for relevant technical training and professional certifications.
• A structured security operations environment that values accurate analysis and continuous improvement.
• Opportunities to contribute to improved detection coverage and faster, more consistent incident handling.

Application Instructions

Candidates should submit an up-to-date CV through the organisation’s designated application channel. Applications should describe their SOC or security operations experience, SIEM familiarity, investigation skills, and understanding of common cyber threats.

Applicants may include relevant certifications, training, and non-sensitive examples of security investigations or detection improvements. Any examples should avoid disclosing confidential logs, customer information, credentials, or proprietary security configurations.

The recruitment process may include an initial CV review, a technical interview, and a practical assessment involving alert triage, log interpretation, incident classification, and investigation documentation.

Are you interested in this position?

Apply by clicking on the “Apply Now” Button below!

#JobsHubEstonia #GlobalRecruitment
#CareerOpportunities #HiringNow
#JobSeekersNetwork #EstoniaJobs
#RecruitmentServices #EmploymentPortal.