The posting
We are the Intelligent Internet Platform. We connect People, Places and Things anywhere, managing Internet Performance better than anyone else, while providing One Global Experience, giving Visibility, Control and Security through expereoOne.
Expereo believes in the power of Internet connectivity. As the world's largest provider of managed internet, SD-WAN/SASE, and Cloud connectivity solutions, we power enterprises and government sites worldwide, helping to enhance every business' productivity with flexible and optimal Internet performance.
As a trusted partner of Fortune 500 enterprises, our continued aim and success in helping our customers and partners depends solely on the talented individuals who make Expereo a dynamic, effective, multicultural, and equitable environment.
About the role
We are looking for a motivated Level 1 SOC Analyst with one or two years experience in a security operations or similar technical role to join our Security team. You will be monitoring and triaging security alerts, carrying out initial investigation, and escalating confirmed or suspicious activity in line with established playbooks. You will work closely with senior security team members.
Responsibilities
- Monitor security alerts across SIEM, endpoint detection and email security platforms, and carry out initial triage and classification as benign, false positive, suspicious or confirmed incident.
- Perform initial investigation: gather evidence, correlate activity across endpoint, identity, email and network telemetry, and establish whether an alert represents genuine malicious activity.
- Investigate reported and quarantined email, analyze message headers, sender reputation, embedded links and attachments and action or escalate accordingly.
- Execute approved response playbooks for routine cases, and escalate indicators of compromise, lateral movement or data exposure to senior analysts with clear supporting evidence.
- Document each cases: what was observed, the evidence gathered, the assessment reached and the action taken.
- Track open cases through to closure and ensure alerts are handled.
- Support security hygiene activity, including monitoring of security tooling coverage and follow-up on devices falling outside policy.
- Contribute to triage procedures, runbooks and operational reporting, and support awareness activities such as phishing simulation campaigns.
Requirements
Essential Skills and Experience
- Practical experience operating a SIEM in a Level 1 capacity, alert queue management, triage, classification and escalation.
- Hands-on exposure to enterprise security platforms, such as Microsoft Defender, Elastic Security, Microsoft Sentinel, Splunk or CrowdStrike.
- Ability to search and interpret log data, and to draw conclusions from incomplete information.
- Understanding common attack techniques such as phishing, credential theft, malware delivery and social engineering.
- Email security fundamentals, including message headers and sender authentication (SPF, DKIM, DMARC).
- Networking, Windows and Linux fundamentals sufficient to interpret host and network telemetry.
- Clear written English for case documentation and escalation.
- Methodical and consistent under repetitive workload, with sound judgement on when to escalate rather than proceed.
Desirable
- Exposure to cloud security monitoring, particularly within Microsoft Defender and a plus (AWS environments).
- Query language knowledge in KQL, Lucene, EQL, or equivalent.
- Familiarity with the MITRE ATT&CK framework.
- Experience with endpoint management or device compliance platforms.
- Entry-level certification such as SC-200, CompTIA Security+, CompTIA Network+ Blue Team Level 1.
- Basic scripting knowledge (PowerShell, Python).
Benefits
Beyond the Job
We’re proud of our focus on Environment, Social and Governance as well as the passion we display for the communities where we live and work.
EEO (Equal Employments Opportunities) Statement:
Expereo is an Equal Opportunities employer who aims to support and celebrate every employee that comes through our doors. We respect and support all of our people regardless of background, religion, nationality, sexual orientation, age, or physical condition.
