Senior SOC Analyst (Tier 3 Incident Response)

About the role

Syntegon Telstar S.R.U, part of the Syntegon Group, is looking for a Senior SOC Analyst for its office in Terrassa (Barcelona). This Tier 3 role leads the detection, triage, investigation and response to complex security threats and acts as a technical escalation point for critical incidents. You will also mentor junior analysts, improve SOC processes and strengthen detection and response capabilities.

Key responsibilities

• Lead triage, investigation and escalation of complex or high-severity alerts across endpoint, network, identity, cloud and application domains.
• Drive end-to-end incident response for major events, coordinating with IT, Cloud, Identity and business stakeholders, and produce incident reports with root cause analysis and remediation recommendations.
• Run proactive threat hunts based on intelligence and adversary TTPs, identify detection gaps and work with the SOC Engineer to turn findings into better detections.
• Use SOAR platforms to run and refine automated response workflows and escalate automation opportunities to the SOC Engineer.
• Develop and maintain IR playbooks, runbooks and SOPs, and ensure incident handling meets compliance requirements with audit-ready records.
• Coach Tier 1-2 analysts and act as an escalation point, supporting training and knowledge sharing.

Required profile

• 4-6+ years in cybersecurity, including 3+ years in a SOC analyst or incident response role.
• Deep understanding of the incident response lifecycle and experience with complex, multi-domain incidents.
• Strong knowledge of attacker TTPs, threat actors and the MITRE ATT&CK framework.
• Strong written and verbal communication, able to write clear incident reports for technical and non-technical audiences.
• Preferred: threat hunting experience, scripting or automation exposure (e.g. Python, PowerShell), MSSP/MDR environment experience, and familiarity with forensics, malware triage or reverse engineering.

Required skills

• Incident response and threat hunting
• MITRE ATT&CK
• SOAR platforms
• Endpoint, network, identity and cloud attack vectors
• Threat intelligence
• Preferred: Python, PowerShell, forensics, malware triage, eDiscovery and chain-of-custody

Applications should be submitted in English. Travel of about 10-20% is required when needed (HQ in Germany).