Security Operations Center Analyst

Unleash your potential to combat cyber threats and shape the future of cloud security with innovative threat detection and incident response strategies.

Portugal —100% Full Remote (Need to be based in Portugal)

As a SOC Analyst (Tier 1/2) , you will be working for our client, a leading organisation protecting digital assets across multi-cloud environments. You will be both the first line of defence and the technical investigator behind it — owning real-time monitoring, triage, validation, and incident response across an advanced enterprise security stack.

Your main responsibilities:

• Continuously monitor security alerts across the digital footprint using a SIEM (e.g. Elastic SIEM), network detection (e.g. Darktrace), and EDR/XDR (e.g. CrowdStrike Falcon), and perform initial validation to separate genuine anomalies from false positives (Tier 1).
• Investigate verified alerts in depth — correlate endpoint, cloud, and network telemetry to reconstruct attack timelines and assess threat impact (Tier 2).
• Monitor, audit, and analyse anomalies across cloud workloads using native security tooling in AWS, Azure, or GCP.
• Contribute to detection use-case development and help build and refine security automation workflows (e.g. Cortex XSOAR).
• Execute containment actions following documented playbooks — isolate compromised hosts, deploy network blocks, or revoke compromised cloud credentials.
• Document findings, log artifacts, and containment actions precisely in the ticketing system, and escalate high-severity or systemic incidents to Tier 3 and the Incident Response lead.

You're ideal for this role if you have:

• Experience in a SOC, security monitoring, or incident response role — roughly 1+ year for a Tier 1 focus, 3+ years for a Tier 2 focus.
• Hands-on experience with a SIEM platform (Elastic SIEM, Splunk, Microsoft Sentinel, IBM QRadar, or similar).
• Experience with EDR/XDR tooling (CrowdStrike Falcon, SentinelOne, Microsoft Defender for Endpoint, Cortex XDR, or similar).
• Familiarity with network detection and response tools (Darktrace, Vectra, ExtraHop, or similar).
• Working knowledge of at least one major cloud platform (AWS, Azure, or GCP) and its native security, logging, and monitoring services.
• A solid grasp of TCP/IP, common attack techniques, and the MITRE ATT&CK framework.
• Strong written communication for clear, precise incident documentation.
• Willingness to work in a 24/7 rotating shift environment.

It is a strong plus if you have:

• Experience with SOAR platforms and security automation (Cortex XSOAR, Splunk SOAR, Tines, or similar).
• Scripting for automation (Python, PowerShell, or Bash).
• Relevant certifications (CompTIA Security+ or CySA+, GIAC GCIH/GCIA, cloud security, or vendor certifications such as CrowdStrike or Elastic).
• Experience in financial services or another regulated environment.

Language Required for the role:

• Fluent English.

Eligibility for the role:

• Only candidates with an existing legal right to work in Portugal will be considered.