Senior SOC Analyst – Microsoft Azure Sentinel

AIOPSGROUP Careers

Staff Security Operations Analyst at AIOPSGROUP ensuring security of internal systems and managing incidents. Collaborating across teams to support audits and optimize security visibility.

Posted 6/17/2026full-timeSofia • 🇧🇬 BulgariaSeniorWebsite

Tech Stack

Tools & technologies

AWSAzureCloudCyber SecurityFirewallsGoogle Cloud PlatformLinuxPythonTCP/IP

About the role

Key responsibilities & impact

Manage internal Corporate Security posture, monitoring security anomalies, building additional detections and visibility mechanisms, and ensuring the overall security of our internal systems.
Work closely with various teams to support audits, optimize visibility, and handle security incidents as they arise.
Act as the primary escalation point for Tier 1 analysts, performing deeper correlation and behavioral analysis on complex, multi-stage security events.
Coordinate and execute tactical containment actions (e.g., host isolation, credential revocation, network blocks) during active, confirmed security incidents.
Integrate active cyber threat intelligence (CTI) feeds and Indicators of Compromise (IoCs) into ongoing investigations to identify sophisticated threat actor campaigns.
Analyze alert queues to identify false-positive trends and collaborate with Tier 3 engineers to recommend precise logic modifications for SIEM correlation rules and EDR policies.
Author, refine, and maintain Standard Operating Procedures (SOPs) and incident response runbooks to reflect evolving adversary tactics and techniques.
Maintain accurate records of incidents, investigations, and security-related activities within the incident management platform.
Create detailed reports on security incidents, response actions taken, and recommendations for improvement.
Research new concepts and present them to the internal team as well as customers.

Requirements

What you’ll need

Strong technical competency in network traffic analysis, log management architecture, endpoint forensics, and parsing diverse event logs across Windows, Linux, and enterprise cloud environments.
Proven experience utilizing defensive frameworks specifically the MITRE ATT&CK matrix and the Cyber Kill Chain to map, trace, and document malicious adversary behavior.
Highly developed analytical mindset with the ability to dissect complex log data, analyze suspicious email artifacts, and interpret endpoint telemetry under operational time constraints.
Excellent English written and verbal communication skills.
Prior experience working within a 24x7 Security Operations Centre (SOC).
Security monitoring experience with one or more SIEM technologies, preferably Microsoft Sentinel.
Knowledge of EDR solutions including Microsoft Defender.
Basic understanding of Windows, Linux and cloud technologies including Microsoft Azure and Office365.
Good understanding of security solutions including SIEMs, Web Proxies, Anti-Virus, Firewalls, VPN, authentication providers and mechanisms, encryption, IPS/IDS.
Basic understanding of networking principles including TCP/IP, WANs, LANs, and commonly used Internet protocols.
Active Certifications: GIAC Certified Incident Handler (GCIH), CompTIA Cybersecurity Analyst (CySA+), Cisco CyberOps Professional, or Blue Team Level 2 (BTL2) (nice to have).
Foundational scripting capabilities (Python, Bash, or PowerShell) to assist in automating repetitive data-gathering or log-parsing tasks (nice to have).
Hands-on familiarity with native monitoring, logging, and security suites within enterprise cloud environments (AWS, Microsoft Azure, or GCP) (nice to have).

Benefits

Comp & perks

Competitive remunerations and benefits package
Opportunity to grow your career and get exposure to international brands, working on complex multi-technology projects
Friendly, yet competitive work environment where everyone’s success is celebrated
Flexible working hours/working location

ATS Keywords

✓ Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills & Tools

network traffic analysislog management architectureendpoint forensicsMITRE ATT&CK matrixCyber Kill ChainSIEM technologiesEDR solutionsscripting (Python, Bash, PowerShell)incident responsesecurity monitoring

Soft Skills

analytical mindsetcommunication skillscollaborationproblem-solvingattention to detailreport writingresearch skillstime managementadaptabilitycritical thinking

Certifications

GIAC Certified Incident Handler (GCIH)CompTIA Cybersecurity Analyst (CySA+)Cisco CyberOps ProfessionalBlue Team Level 2 (BTL2)