Security Operations Analyst – Cybersecurity SOC

About the role

Join act digital’s cybersecurity team as a Security Operations Analyst. You will work with a range of Microsoft, cloud and SIEM tools to detect, analyse and respond to security threats for our clients.

Key responsibilities

• Monitor, triage and investigate alerts across Microsoft security tools, AWS, SIEM platforms and EDR solutions.
• Analyse network and host logs (firewalls, NIDS/HIDS, syslog, etc.) to determine remediation and escalation steps.
• Identify root causes, direct remediation actions and support incident‑response efforts.
• Follow structured analytical processes and collaborate with other analysts and teams for effective threat management.
• Prepare and present security reports, summaries and findings to clients.
• Contribute to improving CSOC processes, documentation and knowledge‑base updates.
• Gather client information to optimise whitelist tuning, reduce false positives and enhance detection quality.
• Review feedback and implement corrective actions to maintain service excellence.
• Provide ad‑hoc support as required.

Required profile

• Minimum five years of experience in IT security, including alert triage and incident support.
• Proven experience with SOC toolsets (SIEMs, EDRs) and autonomous technical analysis of threats.
• Expert knowledge of Windows, Linux, database, application and web‑server log analysis.
• Strong understanding of TCP/IP protocols and cloud environments (Azure, AWS, GCP).
• Deep knowledge of Microsoft security suite (M365, Azure Defender, Sentinel, XDR) and major SIEM platforms (Splunk, QRadar, ArcSight, ELK).
• Experience with at least one EDR solution (Microsoft Defender, CrowdStrike) and email/network security.
• Fluent written and spoken English.

Required skills

• Microsoft 365
• Azure Security & Defender
• Azure Sentinel / XDR
• Cloud App Security
• AWS
• Google Cloud Platform
• Splunk
• QRadar
• ArcSight
• ELK Stack
• Microsoft Defender for Endpoint
• CrowdStrike
• TCP/IP
• Windows, Linux, macOS
• Firewalls, NIDS/HIDS, syslog
• Python
• Bash
• PowerShell
• Ruby