Security Operations Analyst (SIEM Operations and Threat Detection)

About the role

Talan is looking for a Senior Consultant to join its Cyber Security Operations Center (CSOC), a globally distributed team of cybersecurity professionals protecting complex technology environments. The role focuses on improving threat detection and security operations through security content management, validation of detection mechanisms, onboarding of new security data sources, reporting and process optimization. It combines Security Operations, Threat Detection Engineering, SIEM optimization, cyber risk management and operational excellence. The position is remote and offered as a freelance, full-time contract.

Key responsibilities

• Develop, implement, validate, tune and maintain security monitoring, analytics and detection capabilities across SIEM, EDR, cloud and other platforms
• Support the operation, maintenance and continuous improvement of security monitoring and threat detection services
• Take part in onboarding, integration, testing and validation of security data sources and telemetry feeds
• Manage security content: use case lifecycles, rule reviews, testing, tuning and quality assurance
• Work with threat intelligence, incident response and operations teams to turn requirements into effective detection and monitoring
• Participate in cybersecurity architecture reviews under guidance and contribute to operations metrics, dashboards, KPIs and reports
• Review detections, configurations and processes, gather feedback to reduce false positives and improve detection quality
• Support quality assurance, procedure and documentation updates, and prepare technical reports for internal and external stakeholders

Required profile

• Mandatory 24/7 rotating on-call availability (about one full week every few months), reachable only to handle critical incidents
• At least 5 years of IT experience, including alert triage and incident support
• Proven experience administering a SIEM platform, preferably Splunk or Microsoft Sentinel
• Proven SOC experience with SIEMs, EDRs and autonomous threat analysis, collaboration with Incident Response
• C1 English; customer-facing experience, writing skills and willingness to learn on the job

Required skills

• Deep knowledge of Microsoft security tools (M365, Cloud App Security, Azure, Defender for Endpoints, Azure Sentinel, XDR)
• Deep knowledge of cloud technologies (Azure, AWS, GCP) and SIEM tools (Splunk, QRadar, ArcSight, MS Sentinel, ELK Stack)
• Knowledge of at least one EDR solution (MS Defender for Endpoint, CrowdStrike)
• Knowledge of Linux, Mac and Windows
• Nice to have: SIEM architecture design, AWS monitoring, scripting languages (Bash, PowerShell, Python), and certifications such as MCSE, Azure SC-200, GCIH, CEH, GCFA

What we offer

• Remote position in a multicultural team working on international projects
• Training and career development