L1 SOC Analyst - Sofia

Level 1 SOC Analyst

Title: Level 1 SOC Analyst

Location: Sofia, on site

Job type: Full-Time Permanent

Salary: Negotiable / DOE

About Us

Integrity360 is the largest independent cyber security provider in Europe, with a growing international presence spanning the UK, Ireland, mainland Europe, Africa and the Caribbean. With over 700 employees, across 12 locations, and six Security Operations Centres (SOCs)—including locations in Dublin, Sofia, Stockholm, Madrid, Rome and Cape Town—we support more than 2,500 clients across a wide range of industries. 

Over 80% of our team are technical experts, focused on helping clients proactively identify, protect, detect and respond to threats in an ever-evolving cyber landscape. Our security-first approach positions cyber resilience as a business enabler, empowering organisations to operate with confidence. 

At Integrity360, people come first. We invest heavily in learning, development and progression, fostering a dynamic culture where innovation, collaboration and continuous growth are at the heart of what we do. If you're ready to take your cyber security career to the next level, we’d love to hear from you. 

Job Role / Responsibilities

As a Level 1 SOC Analyst, you will act as the first line of defense, responsible for continuous monitoring, triage, and initial investigation of security events. This role is critical in maintaining security posture and ensuring only high-quality, actionable alerts progress through the SOC pipeline.

Primary Duties/Responsibilities include:

Monitor security events across our security ecosystem, including:

Microsoft Sentinel

Microsoft Defender for Endpoint

Defender for Identity

Defender for Office365

Defender for Cloud Apps

Perform alert triage with clear analytical judgement:

Validate alerts

Assign appropriate severity

Provide full investigative context before escalation

Conduct preliminary investigations:

Identify IOCs, affected systems, attack vectors and potential business impact

Apply frameworks such as MITRE ATT&CK, Cyber Kill Chain, and NIST IR lifecycle

Maintain high-quality documentation and case notes within ServiceNow SIR

Communicate effectively with internal teams and client stakeholders

Contribute to continuous improvement through feedback, tuning suggestions, and knowledge sharing

Demonstrate strong commitment to ongoing professional development

SLA handling/management - Aspire to manage security events in accordance with applicable (response and resolution) SLA’s.

Desired Skills

Demonstrable experience in IT or cybersecurity support, ideally within a SOC or monitoring environment

Solid understanding of cybersecurity fundamentals and CIA principles

Familiarity with SIEM, EDR/XDR, log analysis, and security monitoring workflows

Working knowledge of MITRE ATT&CK and NIST IR processes

Strong analytical and investigative thinking

Excellent written and verbal communication skills

Ability to operate independently within Tier 1 scope

Fluent in English

Ability to work effectively in a fast-paced environment and prioritize tasks accordingly

Certifications/Qualifications (preferred but not required)

CompTIA Security+, ISC2, ISACA, SANS or equivalent

GIAC Security essentials (GSEC)

Blueteam security level 1

#LI-VP1