About the Role
You will build and mature security detection and response capabilities. You will investigate security events, lead incident response, develop KQL detections, integrate log sources, conduct threat hunting, automate SOC workflows, and communicate findings clearly to technical and non-technical stakeholders.
Requirements
•At least 3 years of hands-on SOC experience
•Deep expertise with Microsoft Sentinel
•Proficiency with Microsoft Defender XDR
•Advanced KQL skills
•Experience integrating and managing log sources
•Ability to lead or independently execute incident response investigations
•Understanding of MITRE ATT&CK and adversary techniques
•Experience managing alert escalations
•Knowledge of ISO 27001 or NIST frameworks
•Fluent English
Responsibilities
•Monitor, analyze, and investigate security events in Microsoft Sentinel and Defender XDR
•Lead incident response from triage through post-incident review
•Write, tune, and optimize KQL detection rules
•Onboard and maintain log sources across endpoint, identity, cloud, and network layers
•Manage alert escalation workflows
•Map attacker behavior to MITRE ATT&CK
•Conduct proactive threat hunting
•Build SOC automation workflows
•Develop SOC playbooks, runbooks, and escalation procedures
•Communicate technical findings to executive and non-technical audiences
•Collaborate with IT, DevOps, and engineering to strengthen security
Benefits
•Hybrid role based in Malta with flexibility within European hours
