Senior Security Operations Analyst

• Recycle loop is utilising the latest technology and data to enable customers to make the best possible use of their materials. 
• Comply loop is enabling customers to solve increasingly complex environmental regulatory challenges using data, expert knowledge and thought leadership to drive business accountability across the globe. 
• Re-use loop is providing intelligent technology platforms and agile delivery models for pre-retail logistics and product returns, fulfilment and processing, on behalf of many of Europe’s largest retailers. 

About the role

• Lead complex security incident investigations, applying industry-standard incident management frameworks (NIST, SANS).
• Oversee the end-to-end incident lifecycle, from detection and investigation to containment, remediation and lessons learned.
• Coordinate cross-functional incident response efforts during major security events, providing technical guidance and risk-based recommendations.
• Lead post-incident reviews, conduct root cause analysis and ensure lessons learned are implemented and tracked to closure.

• Analyse security incidents to identify detection, visibility and control gaps, translating findings into prioritised detection requirements for the Cyber Security Engineer.
• Map detection use cases to the MITRE ATT&CK framework and identify opportunities to improve threat coverage.
• Develop and maintain KQL queries for security investigations, threat hunting and detection gap analysis.
• Collaborate with Security Engineering to prioritise detection improvements, identify telemetry gaps and validate new or updated detections.
• Drive improvements in detection accuracy, incident response effectiveness and security operations processes.

• Act as the senior technical escalation point for Security Operations Analysts during complex investigations and critical security incidents.
• Conduct proactive threat hunting using Microsoft Sentinel, SIEM platforms and other security tools.
• Apply threat intelligence and incident analysis to enhance monitoring and detection capabilities.
• Identify opportunities for security automation and collaborate with Security Engineering to define response automation requirements.

• Act as shift leader and senior point of contact during assigned periods, coordinating team activities during major incidents.
• Mentor and support Security Operations Analysts and Junior Analysts in investigation techniques, incident handling and response best practices.
• Ensure high-quality shift handovers, incident documentation and investigation standards.
• Support team development through training, knowledge sharing and constructive feedback.

• Develop and maintain incident response playbooks, detection requirement specifications and investigation procedures.
• Create training materials and maintain the team's knowledge base, promoting security operations best practices.
• Contribute to security architecture discussions, tooling decisions and continuous improvement initiatives.

• Provide clear and timely updates to management and stakeholders on significant security incidents, emerging threats, detection coverage and lessons learned.
• Coordinate with internal teams, external security partners and vendors to support effective incident resolution.
• Represent Security Operations in operational forums, security governance meetings and technology initiatives.
• Deliver incident reports and performance metrics, communicating complex technical issues effectively to both technical and non-technical audiences.

What we need from you

• 5+ years of experience in Security Operations, with a strong focus on incident management, investigation and response.
• Hands-on experience with SIEM platforms, preferably Microsoft Sentinel, including investigations, threat hunting and workbooks.
• Strong proficiency in KQL (Kusto Query Language) for security investigations, threat hunting and detection gap analysis.
• Proven experience leading complex security incident investigations and coordinating cross-functional incident response efforts.
• Solid understanding of incident management frameworks and best practices, including NIST, SANS and ITIL.
• Experience conducting post-incident reviews and translating findings into detection or security control improvements.
• Strong understanding of cyber threats, attack techniques, threat actors and TTPs, including the MITRE ATT&CK framework.
• Experience with security monitoring, threat detection, log analysis and correlation across multiple data sources.
• Hands-on knowledge of security technologies, including EDR, firewalls, IDS/IPS and SIEM platforms.
• Understanding of network protocols, operating systems and security architecture.
• Basic scripting and automation skills using PowerShell or Python.
• Experience with ISO 27001 and SOC 2 compliance frameworks.
• Previous experience in technical leadership or mentoring within a 24/7 operational environment.
• Strong analytical, problem-solving and communication skills, with the ability to make decisions under pressure and communicate complex technical issues to non-technical stakeholders.
• Bachelor's degree in Cybersecurity, Computer Science, IT or a related field, or equivalent professional experience.
• Relevant professional security certification, such as GCIH, CompTIA CySA+, CISSP or an equivalent recognised certification.
• Availability to provide rotational on-call escalation support, work irregular hours during major security incidents and collaborate with global teams across different time zones.

• Experience across multiple security domains, including incident response, threat hunting, digital forensics and security architecture.
• Experience with additional SIEM platforms such as Splunk, IBM QRadar or Elastic.
• Knowledge of cloud security monitoring across Azure, AWS and Microsoft 365.
• Experience with detection engineering, including SIEM analytics rule development, detection-as-code and MITRE ATT&CK coverage mapping.
• Familiarity with SOAR platforms, security orchestration and automation workflows, including Microsoft Sentinel playbooks, Logic Apps and Azure Automation.
• Experience with threat intelligence platforms, proactive threat hunting methodologies and security tool implementation or optimisation.
• Knowledge of malware analysis, network forensics and packet analysis tools such as Wireshark.
• Advanced scripting, automation and integration skills, or experience with reporting tools such as Power BI.
• Exposure to red team/purple team exercises and security transformation projects.
• Additional certifications such as Microsoft SC-200, GCFA, GREM, GNFA, CISM, CEH or relevant SANS and cloud security certifications.
• Master's degree in Cybersecurity or a related field.

What we offer

• International & Collaborative Environment: Join a friendly, diverse and international team of colleagues who share your passion for innovation, agile working and professional growth, while contributing to the exciting and dynamic field of Reverse Logistics.
• Hybrid Working: Enjoy the flexibility of a hybrid working environment, subject to the operational requirements of the role and its 24/7 shift schedule.
• Learning & Development: Benefit from continuous training and development opportunities, stay up to date with the latest technologies and enhance your expertise in cybersecurity and IT operations.
• Competitive Compensation: Receive a competitive salary and additional benefits, including extra compensation for working unsociable hours as part of the 24/7 shift rotation.
• Modern Office: Work in a welcoming, comfortable office conveniently located near Bucharest's city centre and designed to make you feel at home.
• Time Off & Volunteering: Enjoy 23 working days of annual leave, 2 additional days for volunteering activities and an extra day off to celebrate your birthday.
• Meal Vouchers: Receive meal vouchers worth 45 RON per working day, taxed in accordance with current legislation.
• Private Healthcare: Benefit from a private medical subscription with Medicover.