SOC Analyst

About the Position

SOC Analyst

We are looking for a SOC Analyst to join our cybersecurity team in Warsaw, Poland, specializing in threat detection and incident response.

Responsibilities

• Monitoring security alerts in SIEM systems (Splunk, Microsoft Sentinel, QRadar, Elastic) in 24/7 or shift mode
• Triage and classification of incidents by priority and reduction of false positives
• Analysis of logs from firewalls, EDR, proxy, DNS, and identity systems for anomalies
• Initial response to incidents (containment) and escalation to the Incident Response L3 team
• Threat hunting based on indicators of compromise (IoC) and MITRE ATT&CK tactics
• Creation and tuning of detection rules and event correlation
• Handling phishing reports and analysis of suspicious attachments in a sandbox
• Documentation of incidents in the ticketing system and reporting in accordance with SLA
• Collaboration with IT teams and support of compliance processes (NIS2, DORA, ISO 27001)
• Participation in post-incident reviews and updating SOAR playbooks

Requirements

• SIEM: Advanced - Splunk SPL, Microsoft Sentinel (KQL) or QRadar – creating rules and dashboards
• EDR/XDR: Advanced - CrowdStrike, Microsoft Defender, SentinelOne – analysis and containment
• MITRE ATT&CK: Practical - Mapping attack techniques and building detection
• Networks and Protocols: Solid - TCP/IP, DNS, HTTP/S, traffic and firewall log analysis
• Malware Analysis: Basic/Intermediate - Sandbox, static analysis, IoC extraction
• Operating Systems: Solid - Windows Event Logs, Sysmon, Linux logs
• Scripting/Automation: Welcome - Python or PowerShell to support SOAR
• Certifications: Bonus - Security+, CySA+, GCIH, BTL1, AZ-500
• Threat Intelligence: Practical - Using IoC feeds and TIP platforms
• English: B2+ - Technical documentation, communication in international teams

Salary

SOC Analyst at the mid level earns 11,000–18,000 PLN gross/month on an employment contract, and on a B2B contract, rates reach 130–170 PLN/h net. Shift work 24/7 increases the salary with night and weekend allowances.

• Location: Warsaw and work for international clients increase the range by 10–20%
• Industry: Banking, insurance, and DORA sector pay above the median
• Certifications: GCIH, CySA+, or AZ-500 increase the rate by 1,000–2,500 PLN/month
• Experience: Knowledge of threat hunting and SOAR moves the candidate to the upper range
• Work Model: Shift work 24/7 vs. day mode affects the allowances

We Offer

• Private healthcare
• Training budget for certifications (exam voucher + course)
• Access to cyber labs
• Sports card
• Hybrid or fully remote work for non-shift roles

About the Company

SmartWays.io

SmartWays.io is a leading recruitment agency specializing in cybersecurity roles. With over 6 years of experience in the market and a team of over 20 professionals, we have helped over 3,000 satisfied clients. Our partnership approach ensures knowledge exchange, necessary reports for business decisions, and attention to your needs.

Recruitment Process

1. Analysis of Needs and Profile (1–2 days) – We determine the SIEM/EDR stack, shift model, and regulatory requirements
2. Active Search and Outreach (5–8 days) – We reach out to passive candidates from SOC and MSSP teams
3. Technical Screening (3–5 days) – Incident case triage and verification of MITRE ATT&CK knowledge
4. Presentation of Shortlist and Client Interviews (3–5 days) – 3–4 matched profiles
5. Offer and Onboarding (2–3 days) – Support for negotiations and formalities

We typically close the entire process within 3–4 weeks from the brief to the signed offer, with a guarantee of replacement in case of earlier candidate departure.

FAQ

How much does a SOC Analyst earn in Poland in 2026?

A mid-level SOC Analyst earns 11,000–18,000 PLN gross/month on an employment contract, and on a B2B contract, 130–170 PLN/h net. Shift work 24/7 and certifications like GCIH or CySA+ increase the actual salary.

What is the difference between a SOC Analyst L1 and L2?

L1 deals with triage and initial classification of alerts, while L2 conducts in-depth incident analysis, threat hunting, and tuning detection rules. The mid level most often corresponds to L2 or strong L1.

Which certifications are most valued for a SOC Analyst?

The most significant are CompTIA Security+ and CySA+, GIAC GCIH, Blue Team Level 1 (BTL1), and Microsoft AZ-500 for Sentinel/Defender environments.

How long does it take to recruit a SOC Analyst through Smartways.io?

Typically 3–4 weeks from the brief to the signed offer, with a shortlist presentation after about 8–12 working days.

Can a SOC Analyst work remotely?

Yes, day shift roles are often fully remote or hybrid. Shift positions in 24/7 teams usually require access to secure infrastructure and work from the office or client's SOC.

Do you also recruit related technical roles?

Yes, in addition to SOC Analysts, we also recruit for positions such as system administrator, ETL developer, and Unity developer, supporting entire IT and security teams.

Hire a SOC Analyst

Our specialists are ready to join your team.

Hire