Hybrid role // Location: Iasi, Bacau or BucharestKey ResponsibilitiesMonitor security alerts and telemetry across multiple client environments simultaneously, prioritizing based on severity and business context per clientPerform Tier 2-level triage and investigation of alerts generated by Microsoft Sentinel, Microsoft Defender (XDR/Endpoint/Identity/Cloud Apps) and Darktrace, correlating signals across tools to determine true positive vs. false positiveLead incident response for confirmed threats: containment, eradication and coordinating with client points of contact through resolutionTune detection rules and analytics in Microsoft Sentinel to reduce noise and improve fidelity across different client tenantsDocument investigations, incident timelines and root cause analysis clearly enough for both internal review and client-facing reportingMaintain and apply client-specific runbooks, escalation paths and SLAs — recognizing that a "normal" alert for one client may be critical for anotherSupport onboarding of new client environments into the SOC, including baseline development and initial tuningMentor and provide guidance to Tier 1 analysts on investigation techniques and tool usageParticipate in an on-call rotation to support escalations and critical incidents outside business hoursStay current on emerging threats, TTPs and vulnerabilities relevant to the client base, and proactively suggest detection improvementsMonitor security alerts and telemetry across multiple client environments simultaneously, prioritizing based on severity and business context per clientPerform Tier 2-level triage and investigation of alerts generated by Microsoft Sentinel, Microsoft Defender (XDR/Endpoint/Identity/Cloud Apps) and Darktrace, correlating signals across tools to determine true positive vs. false positiveLead incident response for confirmed threats: containment, eradication, and coordinating with client points of contact through resolutionTune detection rules and analytics in Microsoft Sentinel to reduce noise and improve fidelity across different client tenantsDocument investigations, incident timelines, and root cause analysis clearly enough for both internal review and client-facing reportingRequirements2-4 years of experience in a SOC analyst role, ideally with exposure to a managed services or multi-tenant/multi-client environmentHands-on experience with the Microsoft security stack: Microsoft Sentinel (KQL query writing required), Microsoft Defender for Endpoint, Defender for Identity, Defender for Cloud Apps, and Microsoft 365 DefenderFamiliarity with Darktrace (or comparable NDR/AI-based detection tooling) for network-based threat detection and investigationSolid understanding of the incident response lifecycle, MITRE ATT&CK framework, and common attacker TTPsWorking knowledge of networking fundamentals (TCP/IP, DNS, firewalls, proxies) and Windows/Active Directory environmentsStrong written communication skills — comfortable producing clear incident summaries for both technical and non-technical (client-facing) audiencesAbility to context-switch effectively and manage priorities across multiple client environments with differing risk profiles and SLAsComfortable working independently while knowing when to escalate Show more Show less