SOC Analyst Level 1

About Keyrock

Since our beginnings in 2017, Keyrock has emerged as a leading change-maker in the digital asset space. With over 200 team members from 42 nationalities, we operate predominantly remote with hubs in London, Brussels, Singapore, and Paris. We trade on more than 80 exchanges and provide services including market making, options trading, high-frequency trading, OTC, DeFi trading desks, and digital asset management. We are pioneers in adopting the Rust development language and support Web3 startups through our Accelerator Program.

Role Summary

As a SOC Analyst Level 1, you are the first line of defense for monitoring, triaging, and escalating security alerts in Keyrock’s cloud-first, high-availability trading environment. You will follow playbooks and runbooks to validate alerts, enrich investigations, and ensure timely escalation to Level 2/Incident Response.

Core Responsibilities

• 24/7 monitoring and alert triage using SIEM/EDR and cloud security tools.
• Conduct initial investigations by gathering logs, telemetry, and context.
• Escalate confirmed incidents with clear documentation and complete handoff.
• Execute runbooks for events such as phishing, suspicious logins, and malware alerts.
• Map alerts to adversary behaviors like MITRE ATT&CK techniques.
• Maintain operational hygiene with accurate shift handovers and watchlist updates.

Minimum Qualifications

0–2 years in a SOC, security monitoring, or IT operations role; practical knowledge of networking, DNS, HTTP(S), identity/authentication, and malware basics; familiarity with log investigations, SIEM and EDR tools, ticketing systems, and basic SOAR concepts; strong written communication for clear documentation; ability to work rotating shifts and on-call, including weekends and holidays.

Preferred Qualifications

Experience in cloud security (AWS/GCP/Azure), familiarity with incident response frameworks (e.g., NIST), exposure to detection engineering or basic scripting (Python/Bash), and knowledge of digital asset ecosystems. Certifications such as Security+, Blue Team Level 1, or SSCP are a plus.

What Success Looks Like (First 60–90 Days)

Success will be measured by consistently accurate triage decisions, strong documentation, reliable shift handovers, and clear recommendations for detection and playbook enhancements.

Key skills/competency

• monitoring
• triage
• escalation
• investigation
• documentation
• shift handovers
• runbook execution
• threat analysis
• SIEM
• EDR