About the role
About us
NinjaOne unifies IT to simplify work for nearly 40,000 customers in 140+ countries
The NinjaOne Unified IT Operations Platform delivers endpoint management, autonomous patching, backup, and remote access in a single console to improve efficiency, increase resilience, and reduce spend. By automating IT and managing all endpoints, organizations give employees a great technology experience at work.
NinjaOne is obsessed with customer success and has retained a 98% customer satisfaction score for more than 5 years.
About the Role
We are seeking a Tier 1 SOC Analyst to join our Security Operations team in a nearshore capacity. This role is responsible for the initial monitoring, triage, and escalation of security alerts across cloud, endpoint, identity, and SaaS environments. The ideal candidate has strong foundational cybersecurity knowledge, excellent analytical skills, and the ability to clearly document and communicate findings to senior analysts and incident responders.
This position is well-suited for early-career security professionals looking to build hands-on experience in a modern, cloud-centric SOC.
Location: Germany or United Kingdom (Remote)
What You’ll Be Doing
Monitor security alerts and events from SIEM, EDR, cloud security, email security, and identity platforms
Perform initial triage and validation of alerts to determine severity, scope, and potential impact
Distinguish true positives from false positives using documented playbooks and investigative techniques
Escalate confirmed or high-risk incidents to Tier 2/DFIR teams with clear, structured documentation
Collect and preserve initial artifacts (logs, indicators, timelines) to support incident response
Follow established runbooks, escalation paths, and SLAs
Maintain accurate case notes and ticket updates in the case management system
Identify recurring alert patterns and contribute feedback for detection tuning and process improvements
Participate in shift handoffs to ensure continuity of investigations
Maintain awareness of common threat vectors (phishing, malware, credential abuse, cloud misconfigurations)
Required Qualifications
1–3 years of experience in a SOC, NOC, IT security, or related technical role
Basic understanding of:
Security monitoring and alert triage
Networking fundamentals (TCP/IP, DNS, HTTP/S)
Windows and/or macOS operating systems
Common attack techniques (phishing, brute force, malware delivery)
Experience working with at least one of the following:
SIEM platforms (Splunk, Panther, Sentinel, QRadar, etc.)
Endpoint detection and response (EDR/XDR) tools
Cloud platforms (AWS, Azure, GCP) at a basic level
Strong written English skills for documentation and escalation
Ability to work effectively in a remote, distributed team environment
Willingness to work scheduled shifts aligned with US business hours (including occasional weekends or on-call, if required)
Preferred Qualifications
Hands-on experience triaging alerts in a production SOC environment
Familiarity with MITRE ATT&CK framework
Exposure to cloud-native security signals (CloudTrail, Azure AD logs, SaaS audit logs)
Experience with ticketing systems (Jira, ServiceNow, etc.)
Entry-level security certifications (one or more preferred, not required):
Security+
SSCP
Blue Team Level 1 (BTL1)
AWS Cloud Practitioner or equivalent
Key Skills
Analytical thinking and attention to detail
Ability to follow procedures while knowing when to escalate
Clear written communication and structured documentation
Calm, methodical approach during high-volume alert periods
Strong curiosity and desire to grow into Tier 2 / DFIR responsibilities
What You’ll Love
Flexible working days with unlimited PTO; balance your life and work.
Grow personally and professionally with one of the fastest-growing companies.
Access to our Corporate Benefits Platform (Expedia, FitX, Zalando, and more).
Develop your skills through our renowned training platform.
Competitive compensation.
Collaborate with a curious, kind, international team.
#LI-CR1
#LI-Remote
All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, genetic information, marital status, veteran status, or any other status protected by applicable law. We are committed to providing an inclusive and diverse work environment.
Candidate Privacy
When you apply, NinjaOne collects and uses your personal information to review your application and manage the hiring process. To learn how we use, store, and protect your data, and what your rights are, please read our Candidate Privacy Policy at
https://www.ninjaone.com/candidate-privacy-policy
.