Security Operations Center (SOC) Analyst

About the role

Join the digital competence centre of a leading rail group as a Security Operations Center Analyst. You will be part of a global cybersecurity team that protects critical rail and digital assets, monitors threats, and ensures rapid response to incidents.

Key responsibilities

• Monitor security alerts from EDR, identity protection, cloud security platforms and other tools.
• Perform triage, enrichment and classification of alerts following SOC playbooks.
• Investigate low‑ to medium‑complexity attack patterns such as AitM attacks, suspicious logins, malware detections and phishing activities.
• Correlate events across multiple systems to identify malicious behaviour.
• Conduct basic threat hunting using PowerShell, Python, KQL or Bash scripts.
• Act as first responder in incident handling, document findings and escalate to Tier 2/3 analysts or external SOC.
• Execute containment steps defined in playbooks when authorized.
• Collaborate with IT, operations and business units, and participate in daily SOC meetings.
• Maintain accurate investigation documentation and suggest improvements to detection rules and processes.

Required profile

• Strong analytical mindset with interest in cybersecurity and threat detection.
• Ability to work in a fast‑paced environment and communicate technical information clearly.
• Willingness to collaborate with global teams and external partners.

Required skills

• PowerShell scripting
• Python programming
• KQL (Kusto Query Language)
• Bash scripting
• Experience with Endpoint Detection and Response (EDR) tools
• Familiarity with cloud security platforms
• Use of ticketing and incident management systems