SOC Analyst

• Ensure level 2 operational cybersecurity activities within the Security Operations Center (SOC)
• Monitor, analyze, and investigate security alerts from SIEM, EDR, and XDR solutions
• Utilize Microsoft Sentinel for detection, analysis, and management of security incidents
• Conduct in-depth investigations to identify the origin, impact, and criticality of incidents
• Ensure the processing of security incidents, from qualification to resolution or escalation
• Analyze logs, security events, and indicators of compromise (IoC)
• Participate in the different phases of Incident Response: detection, investigation, containment, remediation, and post-incident follow-up
• Perform Threat Hunting activities to identify suspicious behaviors and potential threats
• Contribute to the creation, improvement, and optimization of SIEM detection rules and use cases
• Identify and reduce false positives to improve the relevance of security alerts
• Use the MITRE ATT&CK framework to analyze and classify attack techniques
• Collaborate with SOC L1/L3, Infrastructure, Network, and Security Engineering teams
• Participate in the continuous improvement of detection and response procedures
• Document investigations, incidents, and remediation actions
• Contribute to the drafting and improvement of operational procedures, playbooks
• Produce incident reports, dashboards, and monitoring indicators for SOC activities
• Participate in technical exchanges with internal teams to strengthen the organization's security posture
• Ensure the operational continuity of SOC services in accordance with availability and quality of service requirements

What they ask

• Confirmed experience as SOC Analyst L2, Security Operations Analyst, Cybersecurity Analyst, or Incident Response Analyst
• Ideally 3 to 5 years of experience in operational cybersecurity, including significant experience within a SOC
• Practical experience with Microsoft Sentinel / Azure Sentinel in a professional environment
• Good command of SIEM solutions and Security Monitoring processes
• Confirmed experience in cybersecurity incident investigation and management
• Good knowledge of EDR/XDR solutions, ideally Microsoft Defender XDR
• Proficiency in analyzing logs, alerts, and security events
• Good knowledge of KQL (Kusto Query Language) for analysis and investigation
• Experience in creating, optimizing, or improving SIEM detection rules
• Good command of Incident Response and Threat Hunting methodologies
• Knowledge of the MITRE ATT&CK framework and common attack techniques
• Good understanding of Windows, Linux, Active Directory, network, and cloud infrastructure environments
• Ability to analyze complex incidents, identify their causes, and propose appropriate corrective actions
• Experience in writing incident reports, procedures, and technical documentation
• Experience with SOAR tools and security process automation is a plus
• Experience in industrial, energy, or critical infrastructure environments is particularly valued
• Certifications such as Microsoft SC-200, CompTIA CySA+, Security+, BTL1 or equivalent are a plus
• Ability to work autonomously, with rigor, reactivity, and excellent analytical skills
• Good communication skills and ability to collaborate with different technical teams
• Languages: Professional English (mandatory), Professional French or Dutch (mandatory). Mastery of all three languages is a significant asset.