L1 SOC Analyst (all genders)

The role

Our SOC in Munich runs SOC as a Service for our customers, monitoring their IT environments in shifts 365 days a year. They include operators of critical infrastructure and companies subject to NIS2. As an L1 analyst, you are the first to assess an alert. You review events in the SIEM, check them against logs and telemetry, and hand confirmed incidents over to Level 2 and Level 3.

This is a full-time, remote position for candidates based in a country of the European Union, starting immediately.

Key responsibilities

• monitor and triage security events 24/7 in Splunk Enterprise (SIEM) and Microsoft Defender XDR
• investigate alerts using raw logs, network telemetry and endpoint alerts, and separate false positives from real incidents
• document validated security incidents and escalate them to Level 2 or Level 3
• take initial response actions during off-hours or in critical situations, following the rules agreed with the customer, for example isolating a host via Defender, disabling an account or blocking an IP address
• keep clear, concise records of all triage activities and investigations in the ticketing system
• work with senior analysts and engineers to refine detection rules, reduce alert fatigue and improve response playbooks

Requirements

• 1 to 3 years of hands-on experience in a SOC or IT security role
• a solid working knowledge of Splunk: searching logs, navigating dashboards, writing basic SPL queries
• experience with Microsoft Defender XDR and Defender for Endpoint, in particular alert investigation and host isolation
• familiarity with networking concepts (TCP/IP, DNS, firewalls, VPNs) and with Windows and Linux
• basic knowledge of the threat landscape, common attack techniques (MITRE ATT&CK) and malware behavior
• willingness and ability to work a 24/7 rotating shift schedule, including day, evening, night and weekend shifts
• strong analytical and problem-solving skills under pressure
• fluent English, written and spoken
• you must be a legal resident of the European Union, due to KRITIS and NIS2 compliance and data sovereignty requirements

Preferred qualifications

• experience working in critical infrastructure
• experience with SOAR tools (Security Orchestration, Automation and Response)
• certifications such as CompTIA Security+, CompTIA CySA+, Microsoft SC-200 or Splunk Core Certified Power User