> Markdown version of [/jobs/ext/4037570-soc-analyst](https://www.wearedevelopers.com/jobs/ext/4037570-soc-analyst). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# SOC Analyst

- **Company:** Andersen Software
- **Location:** Austria
- **Experience:** Starter
- **Contract:** Permanent contract
- **Skills:** Microsoft Windows, Cyber Security, Database Queries, Intrusion Detection Systems, Python (Programming Language), Network Forensics, Windows PowerShell, Anti-Phishing, Kusto Query Language, Security Information and Event Management, Wireshark, Scripting, Mitre Att&ck, QRadar, Cybercrime, Microsoft Sentinel, Splunk
- **Published:** October 5, 2026
- **Apply:** https://www.indeed.com/viewjob?jk=1b8c0265086e9a97

## About the Role

* Experience in cybersecurity for 4+ years, including 1-2 years in a SOC at Tier 2 level.
 * Hands-on work with at least one major SIEM (Microsoft Sentinel, Splunk, QRadar or Elastic) and at least one EDR/XDR tool.
 * Investigation skills across endpoint, network, email and identity (including Microsoft 365 and Entra ID).
 * Writing queries in KQL, SPL or equivalent.
 * Working knowledge of MITRE ATT&CK and common attack techniques.
 * Readiness for shift work and on-call rotation.
 * Clean record, ready for background verification.
 * Level of English - from Upper-Intermediate and above., * Certifications: CySA+, SC-200, BTL1/BTL2, GCIH.
 * Threat hunting experience.
 * MSSP or multi-tenant SOC experience.
 * SOAR experience.
 * Network traffic analysis (Wireshark, Zeek, IDS/IPS).
 * Scripting in Python or PowerShell.

## Description

* Investigating alerts escalated from L1/L2 across endpoint, network, email and identity.
 * Deciding whether alerts are true incidents, assess scope and escalate confirmed incidents to Incident Response.
 * Investigating email and identitying threats in Microsoft 365 and Entra ID (phishing, suspicious sign-ins, account compromise).
 * Proposing detection tuning and new use cases to the SIEM team, based on investigation findings.
 * Writing detailed case notes and periodic reports.
 * Taking part in shifts and on-call rotation as defined in the request.