Security Operations Center (SOC) Analyst (Poznań - hybrid)

• Use CrowdStrike Falcon Next-Gen SIEM as the primary platform for real-time monitoring, query-based analysis, detection review, event correlation, case management, and reporting.
• Review, prioritize, and classify alerts using the established severity matrix and SOC operating procedures.
• Determine whether alerts represent false positives, benign activity, suspicious activity, policy violations, or potential security incidents.
• Conduct triage, detailed investigation, evidence review, response coordination, and closure documentation for assigned alerts and incidents.
• Analyze and interpret first-party detections, third-party detections, and correlation rule outputs.
• Maintain accurate triage decisions, evidence notes, and investigation updates in the incident management platform.

Incident Response & Remediation

• Ensure incidents are handled promptly in line with SOC runbooks, escalation workflows, and operational expectations.
• Execute approved Cybersecurity Incident Response Plan activities and associated SOC playbooks.
• Support containment, eradication, and recovery activities in coordination with IT resolver teams, platform engineering, IAM, network security, email security, and infrastructure teams.
• Escalate confirmed major incidents to CSIRT or management stakeholders when escalation criteria are met.
• Assist with root cause analysis documentation for major incidents, repeat incidents, or incidents requiring formal review.

Threat Analysis & Continuous Improvement

• Support threat hunting, detection validation, and investigation workflows using Falcon Next-Gen SIEM.
• Identify vulnerabilities, suspicious activity, threats, exploits, and weaknesses in security controls.
• Create visualizations, summaries, and investigation reports to communicate event details to SOC leadership and operational stakeholders.
• Recommend improvements to detection logic, correlation rules, dashboards, alert handling procedures, and SOC runbooks.
• Review internal and external threat intelligence advisories, indicators of compromise, and relevant adversary activity.
• Support SOC metrics, quality checks, reporting, and continuous improvement initiatives.
• Support audit, compliance, and evidence requests as required.

Shift & Operational Requirements

• Operate within 24x7 security operations and incident response environment.
• Work within a tierless SOC where each analyst may handle triage, investigation, response coordination, documentation, escalation, and closure activities.
• Communicate clearly with technical teams, business stakeholders, management, and, where relevant, legal/privacy and communications teams.
• Follow structured incident response, evidence handling, reporting, and documentation practices.