Divoro

We’re seeking an experienced SOC Analyst to deepen our detection engineering capabilities and incident investigations. If you’ve spent at least two years in a SOC role, love writing and tuning detections, and thrive in a fast-paced, fully remote team—let’s talk.

What you’ll do:
- Detection Engineering & Rule Development
- Design, implement, and maintain detection rules in the SentinelOne XDR platform
- Translate threat-actor TTPs (MITRE ATT&CK) into actionable, low-noise detections
- Alert Triage & Incident Analysis
- Conduct investigations on alerts Identify root cause, scope, and impact; recommend containment & remediation steps
- Shift Rotations & Handover
- Participate in day/night/weekend rotations to ensure 24/7 coverage
- Prepare detailed handover notes and run regular shift‐change briefings
- Analyze alert metrics to drive down false positives and optimize signal-to-noise ratio
- Develop playbooks to streamline common workflows
- Mentor junior analysts and lead post-incident reviews

What we’re looking for: 
- 2+ years of hands-on SOC experience, ideally in a managed detection & response (MDR) or enterprise SOC
- Proven track record in detection engineering: writing, testing, and tuning rules signatures
- Strong expertise with Windows & Linux system forensics, network protocols, and authentication mechanisms
- Experience with cloud native logs & services (AWS CloudTrail, Azure Monitor, GCP Cloud Logging)
- Excellent English communication skills (written and verbal)
- Detail-oriented, proactive, and thrives in a remote, distributed team environment

Bonus points for:
Scripting or development skills in Python, PowerShell, or similar

Hands-on with SOAR platforms

We’re looking for a Junior SOC Analyst with strong English to join our team. This role is more than just monitoring alerts — it’s about making a real impact, digging into incidents, hunting for threats, and helping build smarter defenses for our clients. If you love solving puzzles, staying ahead of attackers, and working with a team that has your back — we’d love to hear from you.

What you’ll do:
— Investigate and validate security alerts using EDR/XDR platforms
— Work in rotating shifts (day/night) with thorough documentation and handovers
— Proactively hunt for threats and suspicious activity in client environments
— Document your findings, analysis, and incident investigations
— Tune detection systems to reduce false positives and improve signal quality

What we’re looking for:
— Communicate clearly in English, both written and spoken (MUST)
— Near 0.5-1 year of experience in a SOC
— Solid understanding of core cybersecurity concepts (network protocols, authentication, encryption)
— Experience working with Windows and Linux/Unix systems
— Familiarity with common attacker tactics, techniques, and procedures (TTPs), especially using the MITRE ATT&CK framework
— Have strong analytical and problem-solving skills
— Are detail-oriented, proactive, and always eager to learn something new

Bonus points for:
— Experience with cloud environments like AWS, GCP, or Azure
— Ability to write or adapt detection rules based on MITRE ATT&CK
— Hands-on exposure to incident response, forensics, or threat hunting

Why join us?
At Divoro, we keep things real — no micromanagement, no corporate fluff. Just meaningful work, smart teammates, and plenty of opportunities to grow. We’re fully remote but tightly connected, and we support each other every step of the way.

Sound like a good fit? Apply now — we’d love to talk to you!