KI
Cybersecurity SOC Analyst
Contract type
Ongoing
Work mode
Remote · Europe
Experience
Mid-level · 2+ years
Job description
A hands-on Cybersecurity SOC Analyst role at Kognitiv Inc., focused on investigating security alerts, tuning detection rules and monitoring data loss prevention events. The role supports Kognitiv globally and adds European time-zone coverage alongside North American security coverage.
At a glance
- Employment
- Full-time · Employee (employment agreement)
- Work mode
- Remote · Europe
- Apply before
- December 6, 2026
What you'll do
- Monitor, triage and investigate security alerts in Rapid7 InsightIDR, bringing together logs from firewalls, endpoints and other devices, and help mitigate verified security incidents.
- Write and tune detection rules that correlate events across sources, including endpoint detection and response signals from SentinelOne.
- Identify opportunities to automate triage and reduce manual effort.
- Review DLP events in Cyberhaven to identify potentially inappropriate movement of client or company data, including transfers to personal email or AI platforms.
- Follow up with colleagues and their managers to understand flagged activity and investigate potential security concerns.
- Apply understanding of the technology being protected to distinguish suspicious behavior from expected activity.
- Track emerging threats, malware and cloud vulnerabilities, and contribute findings to incident response playbooks and detection improvements.
What we're looking for
- Hands-on SOC analyst experience investigating alerts and working with SIEM platforms, typically gained over 2-4 years.
- Practical experience with Rapid7, Splunk, Microsoft Sentinel or another SIEM, able to explain how the platform has been used in real investigations.
- Experience working with DLP tools and investigating potential data loss or inappropriate data transfers.
- Querying, scripting or programming skills applicable to security analysis and detection rules (e.g. LEQL, KQL, SPL or Python).
- A broad understanding of IT systems, network protocols and cloud architectures, gained through a relevant technical degree or equivalent industry experience.
- Practical experience with endpoint detection and response (EDR) tools alongside SIEM and DLP work.
- A methodical approach to active investigations and careful attention to log data, network traffic and subtle indicators of compromise.
- Curiosity and a willingness to keep learning as threats, vulnerabilities and attacker tactics evolve.
Nice to have
- Experience with Rapid7, Cyberhaven or SentinelOne.
- Familiarity with MITRE ATT&CK or CIS Controls to support analysis.
- Security+, CySA+, a relevant Splunk security certification or Rapid7 InsightIDR Certified Specialist.
- SIEM engineering or log-platform configuration experience.
Apply
About Kognitiv Inc.
Redefining what it means to be a Workday partner
One of the fastest-growing companies in the Workday ecosystem, bringing deep expertise, innovative thinking and a people-first mindset to everything they do.
Key facts
- Workday partner / IT services
- One of the fastest-growing companies in the Workday ecosystem
- Supports clients globally
- North American security coverage with European time-zone coverage being added
What they value
- Deep expertise
- Innovative thinking
- People-first mindset