SOC Analyst L1
04.2026 – present
Komputronik Biznes
- triaging and analyzing SIEM and EDR alerts - including Windows/AD, Cloudflare WAF, VPN, Office 365 and network traffic;
- building Python tools that support the whole SOC team: my own Mini-SOAR engine, alert enrichment and report generation;
- making threat hunting easier with the Mini-SOAR and user account analyzer modules, which help find threats and analyze correlated account activity;
- complex DQL / Query DSL / Lucene queries combining multiple conditions and data sources;
- adding log sources to the SIEM on my own;
- SIEM configuration and development: adding and editing indices, scripted fields, alert rules and, above all, building complex dashboards;
- co-creating a ticketing system in Alloy that makes work for multiple clients easier and more organized, focusing on its logic and workflow;
- in-depth analysis of Windows/AD and Linux events; comfortable working in Linux (terminal, cron, systemd);
- mapping events to MITRE ATT&CK to keep improving detections and alert rules;
- incident handling: analysis, EDR actions (including host isolation), escalation and reporting;
- working with EDR: CrowdStrike and ESET Protect & Inspect.