Security Operations Analyst (L1)

JustMarkets

Europe

On-site

Who this role is best for

Strong fit for entry-level cybersecurity professionals who monitor and triage security alerts using SIEM tools and correlate cross-domain telemetry, with a focus on Europe-based work and structured case-management workflows.

Best fit for

Individuals who can interpret endpoint, network, and identity telemetry with an investigative mindset
— “Ability to interpret common endpoint, identity, authentication, network, DNS, HTTP, and service or cloud audit telemetry at an initial-investigation level”
Professionals who prioritize clear documentation and escalation practices in case-management systems
— “Ability to create a concise investigation timeline and document evidence, actions, conclusions, and handover or escalation notes in a case-management system”

Things to consider

The role requires strict adherence to runbooks and defined escalation procedures
— “Execute approved low-risk actions only through defined runbooks”
Limited scope for independent decision-making due to defined authority boundaries
— “Recognize the limits of L1 authority and escalate suspected incidents correctly”

How to stand out

Highlight practical experience with SIEM tools and cross-source correlation in your resume
— “At least 1+ year hands-on experience with security alert triage through work, an internship, or a practical lab”
Emphasize your understanding of common attack patterns and threat intelligence context
— “Basic use of indicators of compromise, reputation sources, and threat-intelligence context, with awareness of the MITRE ATT&CK framework”
Showcase your ability to distinguish true positives from false positives in your interview responses
— “Ability to distinguish true positives, false positives, and benign activity”
Include any experience with Python or PowerShell in your application materials for added value
— “Simple Python or PowerShell scripts for investigation and enrichment”

Pace · Fast PacedCollaboration · HighAutonomy · MediumDecision Impact · Team

Derived from job-description analysis by Serendipath's career intelligence engine.

What success looks like

validate security alerts
escalate incidents

Typical background

security operationsnetwork security

Skills & requirements

Required

Security Alert TriageSIEMEDRCase ManagementNetwork SecurityIncident Response

Preferred

PythonPowershellCloud SecurityPhishing Investigation

Stack & domain

SIEMEDRXDRCase-management WorkflowsKQLEQLWindowsLinuxTcp/ipDNSHTTPAuthenticationAccess ControlPhishingCredential AbuseMalware ExecutionSuspicious Account ActivityIndicators Of CompromiseReputation SourcesThreat-intelligence ContextMitre Att&ck FrameworkPythonPowershellCritical ThinkingProblem-solvingCommunicationSecurity+Cysa+CybersecurityFin-tech

About the role

Original posting from JustMarkets via Greenhouse

We are inviting you, a highly motivated and results-oriented Security Operations Analyst to join our team on a full-time basis.
Our team has unique expertise in research, analysis, and product development. By relying on technical insights and a data-driven approach, we create disruptive future-defining innovations of the fin-tech industry that remain our basis for success.
Responsibilities
Monitor prioritized alert queues and validate whether alerts indicate real risk
Enrich cases and correlate relevant endpoint, identity, authentication, network, service, asset, user, timeline, and business context
Perform initial investigations, classify alerts, assess preliminary severity and scope, and document the evidence and reasoning in the case-management system
Close false positives and execute approved low-risk actions only through defined runbooks
Escalate suspected incidents, privileged-account issues, and high-impact or production-impact cases to L2, the manager, or Incident Response
Maintain clear handover notes and support improvements to case quality and runbooks
Requirements
1+ year of commercial hands-on experience in security alert triage, utilizing at least one SIEM platform, with working knowledge of EDR/XDR and case-management workflows.
Ability to build basic searches or queries, filter security events, and correlate related activity across more than one data source (Experience with basic SIEM query languages such as KQL, EQL)
Ability to interpret common endpoint, identity, authentication, network, DNS, HTTP, and service or cloud audit telemetry at an initial-investigation level
Working fundamentals of Windows and Linux, TCP/IP, DNS, HTTP, authentication, access control, and common attack patterns such as phishing, credential abuse, malware execution, and suspicious account activity
Ability to distinguish true positives, false positives, and benign activity; assign a preliminary severity; identify affected users or assets; and recognize when scope or impact is uncertain
Basic use of indicators of compromise, reputation sources, and threat-intelligence context, with awareness of the MITRE ATT&CK framework
Ability to create a concise investigation timeline and document evidence, actions, conclusions, and handover or escalation notes in a case-management system
Ability to follow approved runbooks, perform only authorized low-risk actions, recognize the limits of L1 authority, and escalate suspected incidents correctly
Will be a plus
Simple Python or PowerShell scripts for investigation and enrichment
Exposure to cloud, email-security, or SaaS audit logs and common phishing-investigation workflows
Practical cybersecurity labs or an entry-level certification such as Security+ or CySA+
Experience with MacOS
We offer
20 paid vacation days per year
10 paid sick leave days per year
Public holidays as per the company's approved Public holiday list
Medical budget
Opportunity to work remotely
Professional education budget
Language learning budget
Wellness budget (gym membership, sports gear and related expenses)

Source: JustMarkets careers (Greenhouse)