Security Operations Center Analyst

About the role

Arpya’s 24/7 Security Operations Centre in Tirana is looking for both L1 and L2 analysts to monitor, triage and investigate security events across multiple client environments. You will work in a shift‑based roster, reporting to the SOC Lead and collaborating with a team that serves regulated EU mid‑market clients.

Key responsibilities

• Monitor SIEM and EDR/XDR alert queues, perform first‑line triage, enrich alerts with asset, identity and threat‑intelligence context, and escalate true positives.
• Execute runbooks, contain incidents, document cases, and hand over shifts with structured reports.
• Investigate escalated incidents end‑to‑end, perform root‑cause analysis, and provide containment and recovery recommendations.
• Hunt for threats across endpoint, identity and cloud logs, map findings to MITRE ATT&CK, and tune detection rules to reduce false positives.
• Write and maintain runbooks, mentor junior analysts, and contribute to client service reviews.

Required profile

• Strong fundamentals in TCP/IP, Windows, Linux and Active Directory.
• Good written and spoken English and availability for a 24/7 rota including nights, weekends and public holidays.
• Based in, or willing to relocate to, Tirana.
• 1‑2 years of experience in a SOC, NOC, IT support or security role (strong graduates considered) or 2+ years of hands‑on SOC/incident response experience for senior level.

Required skills

• Familiarity with at least one SIEM or EDR platform.
• Knowledge of common attack techniques and MITRE ATT&CK framework.
• Experience with query languages such as KQL or SPL and log‑analysis at scale.
• Scripting in Python, PowerShell or Bash.

What we offer

• Hands‑on work across multiple EU‑regulated clients (ISO 27001, NIS2, DORA).
• Direct involvement in detection engineering and runbook development.
• Clear career path from L1 to L2 and L3.
• Exposure to a variety of security technologies and environments.