We are inviting you, a highly motivated and results-oriented Security Operations Analyst to join our team on a full-time basis.
Our team has unique expertise in research, analysis, and product development. By relying on technical insights and a data-driven approach, we create disruptive future-defining innovations of the fin-tech industry that remain our basis for success.
Responsibilities
- Monitor prioritized alert queues and validate whether alerts indicate real risk
- Enrich cases and correlate relevant endpoint, identity, authentication, network, service, asset, user, timeline, and business context
- Perform initial investigations, classify alerts, assess preliminary severity and scope, and document the evidence and reasoning in the case-management system
- Close false positives and execute approved low-risk actions only through defined runbooks
- Escalate suspected incidents, privileged-account issues, and high-impact or production-impact cases to L2, the manager, or Incident Response
- Maintain clear handover notes and support improvements to case quality and runbooks
Requirements
- Hands-on experience with security alert triage through work, an internship, or a practical lab, including use of at least one SIEM and exposure to EDR or XDR and case-management workflows
- Ability to build basic searches or queries, filter security events, and correlate related activity across more than one data source (Experience with basic SIEM query languages such as KQL, EQL)
- Ability to interpret common endpoint, identity, authentication, network, DNS, HTTP, and service or cloud audit telemetry at an initial-investigation level
- Working fundamentals of Windows and Linux, TCP/IP, DNS, HTTP, authentication, access control, and common attack patterns such as phishing, credential abuse, malware execution, and suspicious account activity
- Ability to distinguish true positives, false positives, and benign activity; assign a preliminary severity; identify affected users or assets; and recognize when scope or impact is uncertain
- Basic use of indicators of compromise, reputation sources, and threat-intelligence context, with awareness of the MITRE ATT&CK framework
- Ability to create a concise investigation timeline and document evidence, actions, conclusions, and handover or escalation notes in a case-management system
- Ability to follow approved runbooks, perform only authorized low-risk actions, recognize the limits of L1 authority, and escalate suspected incidents correctly
Will be a plus
- Simple Python or PowerShell scripts for investigation and enrichment
- Exposure to cloud, email-security, or SaaS audit logs and common phishing-investigation workflows
- Practical cybersecurity labs or an entry-level certification such as Security+ or CySA+
- Experience with MacOS
We offer
- Tax expenses coverage for private entrepreneurs in Ukraine
- Expert support and guidance for Ukrainian private entrepreneurs
- 20 paid vacation days per year
- 10 paid sick leave days per year
- Public holidays as per the company's approved Public holiday list
- Medical insurance
- Opportunity to work remotely
- Professional education budget
- Language learning budget
- Wellness budget (gym membership, sports gear and related expenses)
Hands-on security alert triage experience with SIEM and EDR/XDR; ability to build queries, interpret telemetry, and follow runbooks; fundamentals of Windows, Linux, TCP/IP, DNS, HTTP, authentication, and common attack patterns.
Key Responsibilities
- monitoring alert queues
- investigating security alerts
- escalating incidents
Skills & Tools
SIEM, EDR, XDR, KQL, EQL, Python, PowerShell, Windows, Linux, TCP/IP, DNS, HTTP, MITRE ATT&CK
Job Details
- Category: Information Technology
- Seniority: Entry Level
- Commitment: Full Time
- Workplace: Remote — Europe
- Languages: English
Benefits
- Generous paid time off
- Tuition reimbursement
About JustMarkets
A global multi-asset broker creating a convenient and transparent trading environment for clients in over 160 countries. — Industry: Finance