Senior Security Operations Center Analyst (f/m/d)

What do we do?

Introducing Thinkproject Platform

Pioneering a new era and offering a cohesive alternative to the fragmented landscape of construction software, Thinkproject seamlessly integrates the most extensive portfolio of mature solutions with an innovative platform, providing unparalleled features, integrations, user experiences, and synergies.

By combining information management expertise and in-depth knowledge of the building, infrastructure, and energy industries, Thinkproject empowers customers to efficiently deliver, operate, regenerate, and dispose of their built assets across their entire lifecycle through a Connected Data Ecosystem.

What your day will look like

We are looking for a highly experienced and technically skilled Senior Security Operations Centre (SOC) Analyst to join our team and play a key role in identifying, investigating, and responding to advanced security threats, issues and vulnerabilities across our organization. This role requires deep expertise in monitoring and securing endpoints, networks, cloud platforms, applications, and infrastructure, with the ability to manage complex incidents independently and drive continuous improvement within the SOC function.

As a senior member of the team, you will lead investigations into sophisticated threats such as advanced persistent threats (APTs), malware outbreaks, and targeted attacks. You will perform hands-on analysis of security events, including forensic evidence collection and root cause analysis, and contribute to the development of detection capabilities across SIEM, EDR, and other monitoring tools.

You will actively engage in threat hunting, leveraging your deep understanding of application code, infrastructure and hosting architectures (cloud and on-premise), the software development lifecycle (SDLC), and CI/CD pipeline solutions to identify risks that span traditional and cloud-native environments. You will also play a key role in implementing and refining automation and playbooks utilising SOAR platforms to accelerate response efforts and reduce operational overhead.

The ideal candidate will have a strong technical foundation and a proactive mindset, with a passion for staying ahead of current and emerging threats. You will collaborate closely with IT, DevOps, and application teams to improve detection coverage, enhance SOC processes, and ensure security operations are aligned with industry best practices and compliance requirements.

This role encompasses reactive incident response, proactive detection engineering, threat hunting, and vulnerability management. You will also contribute to strategic initiatives including penetration testing coordination, security assessments, and audit preparation, while mentoring analysts, sharing threat intelligence insights, and maintaining SOC documentation and workflows.

This role sits within the Product Operations and Corporate IT branch, reporting to the Director of Cyber Security and Networking, and operates as part of the broader Cyber Security, Network, and Security Engineering teams.

Main Responsibilities:

Independently investigate and respond to security alerts and events from SIEM, EDR, and other security tools across endpoints, networks, cloud platforms, and applications. Lead proactive threat hunting activities, leveraging threat intelligence, application logs, and infrastructure telemetry to uncover indicators of compromise or stealthy threat activity. Perform in-depth analysis of logs, API configurations and traffic, container environments, network data, application and infrastructure architecture, as well as data center hosting environments to support threat detection, incident investigation, and root cause analysis. Manage complex cybersecurity incidents end-to-end, including containment, eradication, recovery, and post-incident analysis, while coordinating closely with cross-functional stakeholders. Deploy, operate, configure, and tune SIEM platforms and detection tools to enhance signal accuracy, reduce alert fatigue, and maintain effective detection coverage. Design, build, and maintain incident response playbooks and automation workflows to increase the efficiency, speed, and consistency of incident response processes. Simultaneously manage multiple active investigations and day-to-day SOC operations, effectively prioritising tasks and managing time under pressure. Conduct forensic analysis during investigations, including evidence preservation, malware analysis, memory examination, and root cause identification. Collaborate with DevOps, IT, and development teams to ensure timely containment, mitigation, and remediation of vulnerabilities and threats. Coordinate outputs from security assessment tools and penetration tests, ensuring clear ownership and timely closure of identified issues. Participate in and lead security testing exercises to evaluate and strengthen detection capabilities and response procedures. Drive continuous improvement of SOC operations by identifying logging gaps, proposing monitoring enhancements, and introducing new detection or response technologies. Maintain comprehensive documentation of investigations, incidents, tuning efforts, and threat intelligence to support reporting, knowledge sharing, and audit readiness. Stay current with evolving threat landscapes, adversary techniques, and emerging security tools and practices to strengthen SOC capabilities. Adapt SOC processes, solutions, and procedures to enhance the monitoring of the organization's IT network health. Ensure security operations and incident response practices are aligned with industry-recognized frameworks such as ISO 27001. Implement solutions within CI/CD pipelines to identify and block security issues reaching production environments Support the development and refinement of SOC procedures, training materials, and operational standards to enhance maturity and consistency across the team.