Junior Analyst, Security Operations

ROLE DESCRIPTION SUMMARY

The Junior Analyst, Security Operations is responsible for monitoring security events and conducting end-to-end investigations of assigned security alerts and incidents, from initial detection and assessment through investigation, response coordination, validation, and documented closure.

The Junior Analyst correlates evidence across endpoint, identity, email, network, and cloud environments to determine whether activity is malicious, establish its scope and impact, and identify the actions required to address it. The analyst also performs authorized response actions and coordinates with relevant teams to ensure containment, remediation, and recovery activities are followed through.

The role requires sound analytical judgment, clear documentation, timely communication, and accountability for progressing investigations.

PRIMARY RESPONSIBILITIES / KEY RESULT AREAS

1. Security Monitoring and Prioritization

• Monitor and analyze security alerts and events from security platforms, user reports, and other relevant sources.
• Assess the credibility, urgency, and potential business impact of suspicious activity, prioritizing investigations according to established procedures.
• Enrich alerts with relevant asset, user, threat intelligence, and historical context.

2. End-to-End Investigation

• Own assigned investigations from initial assessment through to evidence-based closure, ensuring cases are actively progressed and outstanding actions are tracked.
• Correlate logs, security telemetry, and other available evidence to reconstruct activity, distinguish legitimate behavior from threats, and identify affected users, systems, and services.
• Investigate endpoint, identity, email, network, and cloud-related activity, using appropriate tools and documented investigation methods.
• Analyze suspicious files, URLs, scripts, processes, and network connections using approved analysis tools and sandbox environments.
• Establish the incident timeline, scope, impact, and likely attack path, identifying the initial access vector and root cause where evidence permits.
• Clearly distinguish confirmed findings, working hypotheses, and evidence gaps, pursuing additional information where required.

3. Response, Remediation, and Closure

• Perform containment and response actions within delegated authority and approved procedures.
• Coordinate with IT, application owners, and other relevant teams to address affected accounts, endpoints, malicious artifacts, and identified security weaknesses.
• Track containment, remediation, and recovery actions, following up on dependencies and escalating delays or unresolved risks.
• Validate the effectiveness of response actions using available evidence and confirm that closure criteria have been met.
• Document the investigation outcome, supporting evidence, actions taken, and any remaining risks or follow-up requirements.

4. Escalation and Collaboration

• Escalate incidents promptly when severity, complexity, business impact, or required actions exceed the analyst’s expertise or authority.
• Provide actionable escalation packages containing the investigation summary, evidence, timeline, scope, actions completed, outstanding questions, and support required.
• Continue progressing assigned investigative and coordination activities during escalation, unless case ownership is formally transferred.
• Collaborate with senior analysts and relevant stakeholders throughout the incident lifecycle.

5. Case Documentation, Communication, and Handover

• Maintain accurate, timely, and traceable case records, including evidence sources, analysis, decisions, response actions, and stakeholder communications.
• Provide clear updates appropriate to the audience, highlighting material findings, risks, blockers, and next steps.
• Deliver structured shift handovers that identify case status, pending actions, ownership, priorities, and escalation requirements.
• Handle investigation evidence and sensitive information in accordance with applicable internal requirements.

6. Continuous Improvement and Operational Quality

• Identify recurring threats, detection gaps, false-positive patterns, and opportunities to improve investigation efficiency.
• Contribute to playbooks, knowledge articles, detection tuning, and automation improvements based on investigation findings.
• Apply relevant threat intelligence to active investigations and share actionable findings with the team.
• Meet established service levels and quality expectations, balancing response timeliness with investigation completeness, evidence quality, and effective resolution.
• Participate in incident reviews, training, and operational readiness activities.

COMPETENCIES

• Investigation ownership: Takes responsibility for progressing cases, following through on actions, and achieving defensible outcomes.
• Analytical and critical thinking: Evaluates evidence objectively, tests hypotheses, and avoids unsupported conclusions.
• Technical problem-solving: Uses available tools and information to investigate unfamiliar or ambiguous activity.
• Judgment and escalation: Recognizes when additional expertise, approval, or coordination is required and seeks support promptly.
• Attention to detail: Produces accurate case records, timelines, and handovers.
• Communication: Explains technical findings clearly and provides concise, actionable updates.
• Collaboration: Works effectively with colleagues and stakeholders across functions and locations.
• Prioritization under pressure: Manages competing investigations while maintaining quality and appropriate urgency.
• Learning agility: Develops technical skills, incorporates feedback, and adapts to evolving threats and technologies.

QUALIFICATIONS & EXPERIENCE

• Required 

• • Bachelor’s degree in Cyber Security, Computer Science, Information Technology, or a related discipline, with 1–3 years of relevant experience; an equivalent combination of education, practical training, and experience will be considered.
  • Practical understanding of security monitoring, incident investigation, and the incident response lifecycle.
  • Ability to investigate security events, correlate evidence from multiple sources, and document clear findings and conclusions.
  • Familiarity with Security Information and Event Management (SIEM), Endpoint Detection and Response (EDR), and security case-management tools.
  • Foundational knowledge of Windows and Linux, networking, authentication, identity security, and common attack techniques.
  • Ability to interpret endpoint, authentication, email, and network logs.
  • Foundational knowledge of suspicious file, URL, and script analysis, including extracting and assessing indicators of compromise using approved tools.
  • Understanding of common threats, including phishing, malware, credential compromise, and unauthorized access.
  • Ability to use search and query capabilities to retrieve and correlate investigation evidence.
  • Strong written and verbal communication skills in English.

• Preferred / Nice to Have

• • Hands-on experience investigating security alerts and incidents in a SOC or similar environment.
  • Experience with cloud and identity security investigations.
  • Familiarity with SOAR platforms, investigation playbooks, and response automation.
  • Scripting skills, such as PowerShell or Python, and experience with security query languages.
  • Exposure to malware analysis, digital forensics, and network traffic analysis.
  • Familiarity with threat intelligence and MITRE ATT&CK.
  • Relevant certifications, such as CompTIA Security+, CompTIA CySA+, BTL1, or GCIH.

OTHER KEY REQUIREMENTS / COMMENTS

• Availability to work shifts.
• Willingness to undergo a NATO/EU SECRET security clearance procedure if required.
• Escalation provides additional expertise or decision-making authority; it does not replace investigation ownership unless responsibility is explicitly transferred.
• The analyst also contributes to improving detection capabilities, investigation procedures, and operational readiness.