Security Operations Analyst – SIEM Operations, Threat Detection

Talan

. Enhance threat detection and cybersecurity operations capabilities within the Cyber Security Operations Center .

Posted 9/25/2026full-timeRemote • CzechiaMid-LevelSeniorWebsite

Tech Stack

Tools & technologies

AWSAzureCloudCyber SecurityGoogle Cloud PlatformLinuxPythonRubyShell ScriptingSplunk

About the role

Key responsibilities & impact

Enhance threat detection and cybersecurity operations capabilities within the Cyber Security Operations Center
Develop, implement, validate, tune and maintain security monitoring, analytics and detection capabilities across SIEM, EDR, cloud and other cybersecurity platforms
Operate, maintain, optimize and continuously improve security monitoring and threat detection services
Onboard, integrate, test and validate security data sources, telemetry feeds and monitoring capabilities
Manage security content and detection use case lifecycles, including rule reviews, testing, tuning and content quality assurance
Collaborate with cyber threat intelligence, incident response and cybersecurity operations teams
Participate in cybersecurity architecture reviews and provide recommendations
Prepare and maintain cybersecurity operations metrics, dashboards, KPIs and service performance reports
Review detection effectiveness, monitoring configurations, operational processes and service deliverables
Analyze operational feedback to reduce false positives and improve detection quality
Contribute to quality assurance, process reviews, control validation, service quality assessments and corrective actions
Maintain CSOC procedures, standards, documentation, knowledge base articles and operational guidance
Prepare and present technical reports, summaries, findings and recommendations to stakeholders
Participate in rotating on-call coverage and resolve critical system incidents when required

Requirements

What you’ll need

+5 years of relevant experience in the information technology field, including triage of alerts and supporting security incidents
Proven experience administering a SIEM platform, preferably Splunk or Microsoft Sentinel SIEM
Proven experience with SOC tools such as SIEMs and EDRs
Ability to autonomously perform technical analysis of security threats and collaborate with the Incident Response team
Deep knowledge of Microsoft Security Tools, including M365, Cloud App Security, Azure, Defender for Endpoints, Azure Security, Azure Sentinel and XDR
Deep knowledge of cloud technologies, including Azure, AWS and GCP
Deep knowledge of SIEM tools such as Splunk, QRadar, ArcSight, MS Sentinel and ELK Stack
Knowledge of at least one EDR solution, such as MS Defender for Endpoint or CrowdStrike
Knowledge of email security, network monitoring and incident response
Linux, Mac and Windows knowledge
C1 English proficiency
Mandatory participation in a rotating 24/7 on-call schedule, approximately one full week every X months
Experience building SIEM architectures from initial design to implementation, including data ingestion pipelines for diverse cloud and on-premises log sources (nice to have)
Proven knowledge of monitoring AWS environments (IaaS, SaaS, PaaS) (nice to have)
Knowledge of at least one general-purpose or shell scripting language, such as Ruby, Bash, PowerShell or Python (nice to have)
Desirable certifications: MCSE, CCNA, Microsoft Azure SC-200, GCIH, CEH, GCFA or any GIAC/similar certification
Excellent communication skills
Customer-facing experience and oral communication skills
Ability to write documentation and reports
Creativity and ability to find innovative solutions
Willingness to learn on the job
Conflict management and cooperation

Benefits

Comp & perks

Remote position
Freelance, full-time contract
Training and career development
Possibility to be part of a multicultural team
Work on international projects