> Markdown version of [/jobs/ext/1986093-soc-analyst](https://www.wearedevelopers.com/jobs/ext/1986093-soc-analyst). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # SOC Analyst - **Company:** Happyrobot Inc. - **Location:** Madrid, Spain - **Contract:** Permanent contract - **Skills:** Amazon Web Services, Microsoft Azure, Bash Shell, Software as a Service, Cloud Computing, Cyber Security, Python (Programming Language), Log Analysis, Performance Tuning, Phishing, Runbook, Security Information and Event Management, Scripting, Mitre Att&ck, Blue Team (Cyber Security) - **Published:** August 8, 2026 - **Apply:** https://www.jobleads.com/es/job/e5694510990e6df91acc1bd9e8584bf61 ## About the Role * 2-3 years as a SOC analyst or in a blue team / detection and response role. * Hands-on alert triage experience with a SIEM and an EDR - investigation, disposition, and escalation. * Log analysis across cloud, identity, and endpoint sources. * Working knowledge of MITRE ATT&CK and common attack patterns. * Clear written incident notes and escalations in English (B2+). * Comfortable operating on a coverage-hours rotation. Nice to Have * Cloud console familiarity with AWS, Azure, or GCP. * Scripting basics in Python or Bash. * Phishing and email threat analysis experience. * Certifications: BTL1, GCIH, Security+, or CySA+. * Exposure to detection tuning or writing simple detection rules. * Prior experience at a SaaS or tech startup., Hire only people who can raise the average; 'exceptional performance is the passing grade.' Ability trumps seniority. We believe the best teams are built on talent density - every hire should raise the bar. We reward contribution, not titles or tenure. We give ownership to those who earn it, and we all hold each other to a high standard. A-players want to work with other A-players - that's how we win. ## Description We are looking for a SOC Analyst to join our team. You will be the consistent, accountable owner of alert triage during coverage hours - bringing the speed, rigor, and communication discipline that transforms alert handling from a best-effort scramble into a reliable, measurable function. This is not a detection engineering or research role. Your deepest strength is triage: prioritizing fast, distinguishing signal from noise, and escalating with the context that lets engineers act immediately rather than re-investigate from scratch. That said, you operate with a continuous improvement mindset - feeding a structured tuning loop with the SOC Engineer and proposing runbook fixes when the playbook doesn't match reality. What You'll Do * Alert Triage Own the queue during coverage hours. Prioritize and disposition alerts accurately and fast - high-severity alerts acknowledged within 15 minutes, all alerts dispositioned within SLA. Know the difference between a true positive and noise, and act accordingly without waiting to be told. * Log & Threat Analysis Pivot across cloud, identity, and endpoint log sources to build a clear timeline when an alert warrants deeper investigation. Use MITRE ATT&CK as a reference frame to understand what you're looking at and what it means in context. * Incident Escalation & Communication Escalate incidents with complete, actionable context - severity reasoning, timeline, affected systems, and recommended next steps. Write clearly in English. Engineers receiving your escalations should be able to act without asking follow-up questions. * Runbook Discipline & Improvement Follow runbooks rigorously. When a runbook falls short - wrong steps, missing cases, outdated assumptions - flag it and propose a fix. Runbooks improve because analysts use them critically, not obediently. * Tuning Feedback Loop Run a weekly feedback cycle with the SOC Engineer. Report false positives, patterns in noise, and cases where detection logic needs adjustment. Improve signal quality over time rather than just processing the same noise on repeat. * Audit Readiness Keep monitoring and response evidence current and organized for SOC 2, ISO 27001, and customer incident response commitments. Triage work that isn't documented doesn't exist for audit purposes - make sure yours does., Create the highest impact in the shortest amount of time. Move fast, but in the right direction. We operate with speed because time is our most limited resource. But speed without focus is chaos. We prioritize ruthlessly, act decisively, and stay aligned. We aim for high leverage: the biggest results from the simplest, smartest actions. We're running a high-speed marathon - not a sprint with no strategy. ## Related Videos - [Checkmate: 5 Real Incidents That Can End a Software Company](https://www.wearedevelopers.com/videos/100126-checkmate-5-real-incidents-that-can-end-a-software-company) - [JavaScript? No. Java Scripts! - Scripting with Java](https://www.wearedevelopers.com/videos/2094-javascript-no-java-scripts-scripting-with-java) - [Passkeys: Truly Phishing-Resistant? Implementation and Pitfalls](https://www.wearedevelopers.com/videos/100156-passkeys-truly-phishing-resistant-implementation-and-pitfalls) - [Technical Documentation - How Can I Write Them Better and Why Should I Care?](https://www.wearedevelopers.com/videos/681-technical-documentation-how-can-i-write-them-better-and-why-should-i-care) - [Intermediate Bitcoin Script](https://www.wearedevelopers.com/videos/25-intermediate-bitcoin-script) - [You can’t hack what you can’t see](https://www.wearedevelopers.com/videos/41-you-can-t-hack-what-you-can-t-see) ## Related Articles - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Data Analyst Salary in the UK](https://www.wearedevelopers.com/magazine/278-data-analyst-salary-in-the-uk) - [Is Software Engineering Over-Saturated?](https://www.wearedevelopers.com/magazine/418-is-software-engineering-over-saturated) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [Dev Digest 131 - AI'm not sure about OSS](https://www.wearedevelopers.com/magazine/472-dev-digest-131-ai-m-not-sure-about-oss) - [Dev Digest 120 - Apple and peers](https://www.wearedevelopers.com/magazine/455-dev-digest-120-apple-and-peers)