SOC Analyst

HappyRobot AI Inc.

Job Overview

Location

Madrid

Job Type

Full-time

Full Job Description

📋 Description

• We are looking for a SOC Analyst to join our team. You will be the consistent, accountable owner of alert triage during coverage hours — bringing the speed, rigor, and communication discipline that transforms alert handling from a best-effort scramble into a reliable, measurable function.
• This is not a detection engineering or research role. Your deepest strength is triage: prioritizing fast, distinguishing signal from noise, and escalating with the context that lets engineers act immediately rather than re-investigate from scratch.
• You operate with a continuous improvement mindset — feeding a structured tuning loop with the SOC Engineer and proposing runbook fixes when the playbook doesn't match reality.
• Alert Triage: Own the queue during coverage hours. Prioritize and disposition alerts accurately and fast — high-severity alerts acknowledged within 15 minutes, all alerts dispositioned within SLA.
• Log & Threat Analysis: Pivot across cloud, identity, and endpoint log sources to build a clear timeline when an alert warrants deeper investigation. Use MITRE ATT&CK as a reference frame to understand what you're looking at and what it means in context.
• Incident Escalation & Communication: Escalate incidents with complete, actionable context — severity reasoning, timeline, affected systems, and recommended next steps. Write clearly in English. Engineers receiving your escalations should be able to act without asking follow-up questions.
• Runbook Discipline & Improvement: Follow runbooks rigorously. When a runbook falls short — wrong steps, missing cases, outdated assumptions — flag it and propose a fix. Runbooks improve because analysts use them critically, not just obediently.
• Tuning Feedback Loop: Run a weekly feedback cycle with the SOC Engineer. Report false positives, patterns in noise, and cases where detection logic needs adjustment. Improve signal quality over time rather than just processing the same noise on repeat.
• Audit Readiness: Keep monitoring and response evidence current and organized for SOC 2, ISO 27001, and customer incident response commitments. Triage work that isn't documented doesn't exist for audit purposes — make sure yours does.

🎯 Requirements

• 2–3 years as a SOC analyst or in a blue team / detection and response role.
• Hands-on alert triage experience with a SIEM and an EDR — investigation, disposition, and escalation.
• Log analysis across cloud, identity, and endpoint sources.
• Working knowledge of MITRE ATT&CK and common attack patterns.
• Clear written incident notes and escalations in English (B2+).
• Comfortable operating on a coverage-hours rotation.

🏖️ Benefits

• Join a world-class team of engineers and builders.
• Backed by top investors including a16z, Y Combinator, Base10, Prysm Capital and Eurazeo.
• Have ownership and autonomy of projects and are encouraged to ship.
• Comprehensive Benefits including healthcare, dental, vision coverage.
• Competitive salary + equity in a high-growth startup.

Skills & Technologies

Python

AWS

Azure

GCP

Onsite

Ready to Apply?

Apply Externally

You will be redirected to an external site to apply.

AI Job Fit Analysis

Pro

See exactly how your profile matches this role — strengths, skill gaps, and what to do about them.

HappyRobot AI Inc.

Visit Website

About HappyRobot AI Inc.

HappyRobot AI builds voice AI agents that automate repetitive phone calls for logistics, freight, and supply-chain companies. Its cloud platform lets shippers, brokers, and carriers offload tasks like appointment scheduling, check calls, and rate negotiation to conversational bots that integrate with TMS, ELD, and CRM systems via API. The company targets mid-market and enterprise freight operations seeking to cut labor costs and accelerate data entry without sacrificing accuracy or carrier relationships.

View Company Profile

Get more remote jobs like this

Subscribe to the weekly newsletter for similar remote roles and curated hiring updates.

Weekly remote jobs and featured talent.

No spam. Only curated remote roles and product updates. You can unsubscribe anytime.