Security Operations Analyst

About the role

Core42 is seeking a hands‑on Security Operations Analyst to lead the technical depth of its 24×7 SOC. You will own incidents from the first alert in Splunk through containment, eradication and recovery while mentoring junior analysts.

Key responsibilities

• Monitor security alerts in Splunk, identify threats, anomalies and malicious activity across the private‑cloud platform.
• Perform triage and investigation, acting as the senior decision point on genuine incidents.
• Investigate EDR and NDR alerts involving malware, credential theft, lateral movement, ransomware and other compromises.
• Own the full incident‑response lifecycle: identification, containment, eradication, recovery and post‑incident review.
• Coordinate containment and remediation actions with platform, infrastructure, network and application teams.
• Develop, maintain and improve incident‑response playbooks and SOPs.
• Create, tune and optimize Splunk correlation searches, alerts, dashboards and SPL queries.

Required profile

• At least four years of hands‑on experience in security operations or incident response.
• Proven ability to handle incidents end‑to‑end and act as an escalation point for less‑experienced analysts.
• Comfort working with virtualized and containerized environments built on OpenStack and Red Hat OpenShift.

Required skills

• Splunk (SIEM) and SPL query writing
• Python, PowerShell, Bash scripting
• Linux, Windows operating systems
• OpenStack, Red Hat OpenShift
• Elastic Security EDR, Corelight NDR
• Cribl Stream, ServiceNow, Jira
• Network security concepts: DNS, IPS, IDS, firewalls, proxies
• Threat‑modeling frameworks: MITRE ATT&CK, Cyber Kill Chain, Diamond Model