SOC Analyst.

Investigate, respond, protect

DEFION operates internationally and our MDR and MTI services (Managed Detection and Response and Managed Threat Intelligence) are growing fast. We are therefore looking for experienced people to join the DRTI team and detect, analyse and mitigate cyber threats for our clients. You will work with CrowdStrike, Microsoft Sentinel and other leading SIEM/EDR platforms.

Here you won't just categorize alerts: you will investigate them thoroughly to determine their origin and impact, apply threat intelligence to anticipate attacks, and carry out mitigation actions to provide the initial response to incidents. You will collaborate with Red Team, Blue Team and detection engineers to improve continuously.

The team is based in Spain and works in Spanish with most of our clients. English is the language we use to coordinate with our team in the Netherlands and with international clients. That is why we are looking for someone who lives in Spain, ideally near Barcelona.

What you would do

• Monitor and analyse security alerts on EDR/SIEM platforms, identify suspicious activity and assess its origin and scope
• Analyse threat intelligence to anticipate potential attacks against clients
• Respond to detected threats: contain, mitigate and minimize the impact
• Write reports and client notifications with clear findings and recommendations
• Improve detection rules, develop procedures and playbooks, automate tasks with scripting
• Take part in client meetings for periodic reviews and onboarding support
• Join the service's 24/7 on-call rotation, planned in advance, shared across the team and compensated

What we are looking for

Must have:

• Fluent Spanish (native or C1 level), spoken and written: it is the team's working language and the language we use with most of our clients
• Living in Spain, ideally near Barcelona. Other situations will be considered case by case
• At least 1 year of experience analysing security alerts on SIEM and/or EDR platforms (CrowdStrike, Sentinel, Cortex, Splunk, Elastic, etc.)
• Knowledge of Windows and Linux system administration
• Solid understanding of networks and protocols: TCP/IP, DHCP, DNS
• Scripting skills in Bash, Python or PowerShell
• Analytical thinking: the ability to correlate events, detect attack patterns and solve complex problems
• Attention to detail and a proactive attitude: the ability to identify anomalies and analyse alerts critically
• Organizational and teamwork skills
• Clear communication in English for international collaboration
• Availability for 24/7 on-call duty

Nice to have:

• Cybersecurity certifications or a master's degree
• Degree in Engineering, Cybersecurity or a related field