Senior Cyber Security Analyst (SOC L3) / DFIR

Quick Facts

• Role: Senior Cyber Security Analyst (SOC L3) / DFIR
• Focus: SOC L3 incident handling, DFIR investigations, threat hunting, and detection engineering

Description

You will independently handle complex cyber security incidents at SOC L3 level and conduct advanced investigations of security events in both on-premise and cloud environments. The role also covers proactive threat hunting, detection engineering (design, creation, and optimization of detection rules and security scenarios), and the development of security playbooks and runbooks. You will work with SIEM platforms using KQL, SPL, or EQL and support security automation via SOAR.

Responsibilities

• Independently resolve complex security incidents at SOC L3 level
• Analyze security events and investigate incidents across on-premise and cloud environments
• Perform threat hunting to proactively find threats and suspicious activity
• Design, create, and optimize detection rules and security scenarios
• Query and tune SIEM detections using KQL, SPL, or EQL
• Create and optimize security procedures, playbooks, and runbooks
• Automate security processes using SOAR
• Analyze attacker techniques and work with Cyber Threat Intelligence (CTI)
• Monitor network security and work with EDR, NDR, IDS/IPS, and WAF
• Collaborate with other security teams and mentor SOC L1 analysts
• Produce technical documentation and propose improvements to security processes

Requirements

• At least 4 years of experience in information security or cyber security
• At least 2 years of practical experience in SOC L3 or as a DFIR specialist
• Advanced knowledge of SIEM platforms and the ability to analyze security logs independently
• Practical experience with KQL, SPL, or EQL
• Experience with Incident Response, Threat Hunting, and Detection Engineering
• Ability to propose custom detection rules and security use cases
• Experience with security technologies such as EDR, NDR, IDS/IPS, WAF, and SOAR
• Knowledge of networking technologies, operating systems, and enterprise IT infrastructure
• Ability to independently analyze complex security incidents and propose corrective actions
• Good communication skills and experience producing technical documentation
• Czech for daily communication and English level B2/C1

Benefits

• Long-term project with planned duration until the end of 2029
• Hybrid work model (3 days onsite, 2 days from home)
• Opportunity to work on an independent contractor (IC / B2B) basis
• Work on complex security challenges in a large banking environment
• Opportunity to use and grow advanced SOC, Incident Response, and Threat Hunting skills
• Technically demanding role with room for autonomy and professional growth