> Markdown version of [/jobs/ext/4677650-security-analyst-tier-2](https://www.wearedevelopers.com/jobs/ext/4677650-security-analyst-tier-2). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Security Analyst - Tier 2

- **Company:** Nebius
- **Location:** Amsterdam, Netherlands
- **Experience:** Expert
- **Contract:** Permanent contract
- **Skills:** Microsoft Windows, User Authentication, Cyber Security, Domain Name System (DNS), Hypertext Transfer Protocols (HTTP), Python (Programming Language), Linux Kernel, Networking Basics, Security Information and Event Management, TCP/IP, Scripting, Mitre Att&ck, 3-tier Architectures
- **Published:** November 12, 2026
- **Apply:** https://www.adzuna.nl/details/5961924850

## About the Role

* Around 5-7 years of hands-on security operations experience, with proven depth in alert investigation.
 * Experience taking investigations to a clear verdict, including confirmed incidents.

Technical Expertise

 * Strong working command of EDR platforms and SIEM-based investigation, including writing and adapting queries independently.
 * Solid understanding of attacker techniques, with the ability to map findings to MITRE ATT&CK in analysis and reporting.
 * Investigation capability across at least two of: endpoint, identity, cloud, email, or network domains.
 * Windows and Linux internals at the depth required for log and artifact analysis: processes, authentication flows, and persistence mechanisms.
 * Solid networking fundamentals: TCP/IP, DNS, HTTP/S, and the ability to interpret network telemetry.
 * Scripting ability (Python or similar) for analysis at scale, and familiarity with SOAR platforms.
 * Certifications such as BTL2, OSDA, or CDSA are an advantage.

Leadership & Communication

 * Intellectual honesty, clearly distinguishing important and vague data, what is known, what is assumed, and what is still unknown.
 * Collaborative escalation habits, hands off with context and stays available to support what comes next.
 * Structured written communication, writing investigation notes that tell the story on their own.
 * Fluent in English, written and verbal, comfortable working with international teams and stakeholders., Applicants must be authorized to work in the country in which they apply and will be required to provide proof of employment eligibility as a condition of hire.

## Description

* Determine scope, impact, and root cause using EDR, SIEM, and supporting telemetry.
 * Escalate suspected incidents to the Incident Response team and complex investigations to Tier 3.
 * Provide structured feedback to relevant stakeholders on detection or prevention quality, false-positive patterns, and coverage gaps discovered during investigations.
 * Contribute to and refine SOC runbooks, triage guides, and investigation procedures.
 * Review Tier 1 escalations, coach on handoff quality, and act as the analytical reference during triage.
 * Document investigations to a standard that supports handoff, quality review, and lessons learned.
 * Participate in the on-call rotation, acting as the investigative point of contact outside business hours.