Qualifications

Certifications (Optional but valued):

• Platform-specific certifications: SC-200, CrowdStrike Certified Falcon Administrator, or Google Chronicle Security Operations.
• GIAC: GCIA, GCIH, or GCFA.
• CompTIA Security+ or CySA+.
• Certified SOC Analyst (CSA) from EC-Council.

Additional Information

English: C1-C2

Company Description

Devoteam is a leading European consultancy focused on digital strategy, technology platforms, cybersecurity, and business transformation through technology.

Technology is in our DNA and we believe in it as a lever capable of driving change for improvement, maintaining a balance that allows us to offer our client portfolio top-tier technological tools, but always with the proximity and professionalism of a team that acts as a guide along the way.

Devoteam has been committed to technology at the service of people for over 25 years. With more than 10,000 people in the group, across 20 countries in Europe, the Middle East, and Africa.

Job Description

We are looking for a Level 2 (L2) Security Analyst for our Security Operations Center (SOC), with solid experience in SIEM/SOAR solutions, especially in Google SecOps, CrowdStrike NG-SIEM, and Microsoft/AWS/GCP ecosystems.

MAIN RESPONSIBILITIES

Detection and Response:

• Analyze and investigate medium-to-high complexity security alerts, with the goal of resolving 80% without the need to escalate to Level 3 (L3).
• Perform root cause analysis on complex incidents, documenting findings and recommendations.
• Coordinate incident responses involving multiple systems and cloud platforms.

Detection Engineering:

• Design, implement, and optimize detection use cases based on the MITRE ATT&CK framework.
• Adjust correlation rules in the SIEM and detection policies in EDR/XDR to reduce false positives.
• Validate and test new detections before their implementation in production.

Platforms and Tools:

• Operate and manage Google Chronicle SecOps, CrowdStrike Falcon Next-Gen SIEM, and PaloAlto XSIAM as primary platforms.
• Manage detections in Microsoft 365 Defender, Azure Sentinel, and AWS Security Hub.
• Use PaloAlto Cortex XSIAM for threat analysis and investigation.

Continuous Improvement:

• Develop automation scripts (Python/PowerShell) for repetitive tasks and alert enrichment.
• Mentor and provide technical support to L1 analysts.
• Contribute to technical documentation, playbooks, and operating procedures.
• Participate in proactive threat hunting exercises.

TECHNICAL REQUIREMENTS

Essential:

• Fluent English (C1/C2 level): both written and verbal communication.
• 2-4 years of experience in SOC operations, with at least 1 year in an L2 role.
• Hands-on experience with at least two of these SIEM/SOAR platforms: Google Chronicle SecOps, Palo Alto XSIAM, CrowdStrike Falcon Next-Gen SIEM, or Microsoft Sentinel.
• Demonstrable experience with EDR/XDR solutions (CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne, Cortex XDR, or Sophos).
• Proficiency in query languages: KQL (Kusto), SPL (Splunk), or SQL.
• Solid knowledge of networks and protocols: TCP/IP, DNS, HTTP/S, network traffic analysis.
• Experience in Microsoft 365 environments (Exchange Online, Azure AD, Defender).

WORKING CONDITIONS

• Contract type: Permanent, full-time.
• Work model: Hybrid (Barcelona).
• On-call: Availability rotations (on-call)