> Markdown version of [/jobs/ext/2926540-soc-analyst](https://www.wearedevelopers.com/jobs/ext/2926540-soc-analyst). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Soc Analyst - **Company:** Bme | Bolsas Y Mercados Españoles - **Location:** Madrid, Spain (Remote available) - **Contract:** Permanent contract - **Skills:** Application Programming Interfaces (APIs), Microsoft Azure, Cyber Security, Continuous Integration, Query Languages, Intrusion Detection and Prevention, Python (Programming Language), Security Information and Event Management, EndPointSecurity, Scripting, Mitre Att&ck, Gitlab, Cybercrime, Cortex XSOAR Platform, Security Orchestration, Automation & Response - **Published:** September 15, 2026 - **Apply:** https://www.buscojobs.com.es/soc-analyst-en-madrid-ID-370764722 ## About the Role We are looking for a hands-on security professional with experience in incident response, threat hunting, and security monitoring. In this role, you will investigate complex alerts, develop and tune detection use cases, support containment and remediation efforts, improve automation and playbooks, and proactively identify threats to strengthen SIX's overall security posture.What You Will DoDevelop, tune, and maintain threat detections and SIEM use cases across endpoint, network, identity, cloud, mail, and M365 environments.Investigate complex security incidents, lead threat analysis, and coordinate containment and remediation activities.Design and improve detection content, SOC automation, SOAR workflows, and incident response playbooks.Conduct proactive threat hunting using threat intelligence and the MITRE ATT&CK framework.Identify detection gaps and continuously enhance SOC capabilities and security posture.Mentor junior analysts and contribute to SOC process improvements and knowledge sharing.What You Bring4+ years of experience in SOC operations, detection engineering, threat hunting, and incident response.Hands-on experience with SIEM, EDR, and SOAR platforms (preferably Sentinel, Elastic, Defender for Endpoint, and Cortex XSOAR). Strong background in detection rule development, security investigations, and threat hunting across multiple telemetry sources.Experience with scripting, automation, APIs, and tools such as Python, GitLab, Azure DevOps, and CI/CD practices.Knowledge of security query languages and frameworks, including MITRE ATT&CK.Strong analytical, communication, collaboration, and mentoring skills.What We OfferHybrid model up to 40% working from home37,5 hours/week with flexible schedule and 29+2 holidaysDaily meal allowanceAdditional Medical Insurance for employee and familyPension fundAccess to technical and language learning platformsFree parking spots, charger spots and shuttle bus (only for Las Rozas - Madrid location) ## Description The Security Operations Center (SOC) is a critical Line of Defense 1 function at SIX, responsible for detecting, investigating, and responding to cyber threats across endpoint, identity, network, cloud, and email environments.We are looking for a hands-on security professional with experience in incident response, threat hunting, and security monitoring.In this role, you will investigate complex alerts, develop and tune detection use cases, support containment and remediation efforts, improve automation and playbooks, and proactively identify threats to strengthen SIX's overall security posture.What You Will DoDevelop, tune, and maintain threat detections and SIEM use cases across endpoint, network, identity, cloud, mail, and M365 environments.Investigate complex security incidents, lead threat analysis, and coordinate containment and remediation activities.Design and improve detection content, SOC automation, SOAR workflows, and incident response playbooks.Conduct proactive threat hunting using threat intelligence and the MITRE ATT&CK framework.Identify detection gaps and continuously enhance SOC capabilities and security posture.Mentor junior analysts and contribute to SOC process improvements and knowledge sharing.What You Bring4+ years of experience in SOC operations, detection engineering, threat hunting, and incident response.Hands-on experience with SIEM, EDR, and SOAR platforms (preferably Sentinel, Elastic, Defender for Endpoint, and Cortex XSOAR).Strong background in detection rule development, security investigations, and threat hunting across multiple telemetry sources.Experience with scripting, automation, APIs, and tools such as Python, GitLab, Azure DevOps, and CI/CD practices.Knowledge of security query languages and frameworks, including MITRE ATT&CK.Strong analytical, communication, collaboration, and mentoring skills.What We OfferHybrid model up to 40% working from home37,5 hours/week with flexible schedule and 29+2 holidaysDaily meal allowanceAdditional Medical Insurance for employee and familyPension fundAccess to technical and language learning platformsFree parking spots, charger spots and shuttle bus (only for Las Rozas - Madrid location)#J-*****-Ljbffr ## Related Videos - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [Fighting the Next Wave of Cybercrime](https://www.wearedevelopers.com/videos/100331-fighting-the-next-wave-of-cybercrime) - [JavaScript? No. Java Scripts! - Scripting with Java](https://www.wearedevelopers.com/videos/2094-javascript-no-java-scripts-scripting-with-java) - [WeAreDevelopers LIVE - Modern DevOps for IoT Devices and More](https://www.wearedevelopers.com/videos/1805-wearedevelopers-live-modern-devops-for-iot-devices-and-more) - [Enabling automated 1-click customer deployments with built-in quality and security](https://www.wearedevelopers.com/videos/83-enabling-automated-1-click-customer-deployments-with-built-in-quality-and-security) - [Deep Fakes: The Lies We Can’t See](https://www.wearedevelopers.com/videos/1187-deep-fakes-the-lies-we-can-t-see) ## Related Articles - [Spanish Business Culture and Etiquette](https://www.wearedevelopers.com/magazine/353-spanish-business-culture-and-etiquette) - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Fully Remote Software Engineer Jobs](https://www.wearedevelopers.com/magazine/447-fully-remote-software-engineer-jobs) - [Top-Paying Tech Jobs (with Salaries)](https://www.wearedevelopers.com/magazine/372-top-paying-tech-jobs-with-salaries) - [Is Software Engineering Over-Saturated?](https://www.wearedevelopers.com/magazine/418-is-software-engineering-over-saturated) - [The 12 Best Jobs for Software Engineers](https://www.wearedevelopers.com/magazine/401-the-12-best-jobs-for-software-engineers)