Senior Security Analyst / SOC

About the role

SITA is looking for a Senior Security Analyst to join its Security Operations Center (SOC) team, reporting to the Senior Manager, Service Operations. The role performs advanced investigations and validation of security alerts and incidents, improves detection quality and monitoring effectiveness, and mentors SOC Analysts. It covers monitoring, detecting, investigating and responding to cybersecurity threats across the enterprise.

Key responsibilities

• Serve as the primary escalation point for SOC Analysts during complex investigations and incident analysis.
• Lead technical investigations of alerts and incidents across endpoint, network, identity, cloud and application environments.
• Validate alert classifications, severity ratings, incident scope and escalation decisions.
• Perform advanced correlation and analysis across SIEM, EDR/XDR, cloud, identity, network and endpoint telemetry.
• Build investigation timelines, collect evidence, document findings and support escalation decisions.
• Escalate confirmed or suspected incidents to the Security Incident Response Team (SIRT) and collaborate throughout the response lifecycle.
• Develop, maintain and tune detection rules, correlation logic, SOC use cases and investigation playbooks.
• Identify false positives, detection gaps and monitoring deficiencies and drive continuous improvements.
• Mentor SOC Analysts through technical coaching, investigation support, quality reviews and knowledge sharing.
• Support vulnerability management, cyber simulations, tabletop exercises, post-incident reviews and SOC improvement initiatives.

Required profile

• 3-5 years of experience as a SOC L2 Analyst or in an equivalent security operations role.
• Bachelor's degree in Information Technology, Cybersecurity, Computer Science or a related field.
• At least one recognized cybersecurity certification such as SC-200, GCIH, GCIA, CySA+ or ECIH.
• NICE-TO-HAVE: vulnerability management experience, participation in cyber simulations, red-team exercises and tabletop exercises, and familiarity with security automation and SOC reporting.

Required skills

• Advanced investigation with SIEM and EDR/XDR platforms, preferably Elastic, Cortex XDR, Microsoft Defender XDR and CrowdStrike Falcon.
• Log and telemetry analysis from endpoints, identity platforms, cloud services, firewalls, proxies, DNS, VPN and applications.
• Detection rule development and tuning; proficiency in KQL, Lucene, EQL and Sigma.
• Working knowledge of PowerShell and/or Python for investigations and automation.
• Knowledge of Windows, Linux, Active Directory, Microsoft 365, Azure/AWS, networking and common attack techniques.
• Solid knowledge of the MITRE ATT&CK framework.

What we offer

• Flex Week: up to two days per week working from home.
• Flex Day: flexible workday.
• Flex-Location: up to 30 days a year working from anywhere in the world.
• Employee Assistance Program and Champion Health.
• Professional development through platforms such as LinkedIn Learning, Pluralsight, Harvard Business Publishing and Stanford.
• Competitive benefits tailored to local market and employment status.