Please note that we will never request payment or bank account information at any stage of the recruitment process. As we continue to grow our teams, we urge you to be cautious of fraudulent job postings or recruitment activities that misuse our company name and information. Please protect your personal information during any recruitment process. While Monks may contact potential candidates via LinkedIn, all applications must be submitted through our official website (monks.com/careers).

About the Role

We are looking for a Senior Security Operations Analyst to serve as our primary operational anchor for EMEA, bridging follow-the-sun operations across global time zones (APAC and the Americas). In this role, you will analyse security events, investigate potential threats, validate and manage high-priority incidents, and execute decisive containment actions to minimise overall impact while escalating unresolved incidents to security engineering teams.

This person will monitor and remediate security incidents across on-prem, identity, and cloud-based environments for internal corporate infrastructure and enterprise client engagements. As the primary responder on shift during EMEA business hours, you should possess deep operational muscle memory, strong technical composure under pressure, and the initiative to challenge assumptions and propose continuous improvements. This is a remote role from either the UK, Ireland, or Poland.

Responsibilities

Lead triage, scoping, containment, and eradication for medium-to-high severity security incidents across endpoint, identity, SaaS, and cloud environments.
Perform deep-dive investigations, threat isolation, and query hunting leveraging CrowdStrike Falcon (Host Timeline, Real Time Response).
Investigate identity compromises, phishing campaigns, and suspicious account activities using Google Admin Console (Investigation Tool, Email Log Search, Token Auditing).
Analyse ingress edge telemetry, CDN traffic patterns, WAF events, and web server logs (including Cloudflare and Acquia application environments) to detect, trace, and mitigate web attacks, DDoS conditions, and botnet/scraping abuse.
Maintain and continuously update incident response plans and runbooks for efficient incident response, collaborating with engineering to automate containment workflows.
Coordinate cross-departmental remediation tasks and escalate unresolved incidents with clear technical root-cause analysis (RCA) aligned with MITRE ATT&CK.
Collaborate with content production for security awareness and mentorship.

About You

The essentials

5+ years of direct experience in Security Operations (SOC), Incident Response, or similar hands-on technical operational roles.
Bachelor’s degree in Computer Science/Engineering/Information Security, or equivalent practical experience.
Deep operational experience utilising CrowdStrike (investigation workflows, Host Timeline, Real Time Response, and query hunting).
Proven experience leveraging Google Admin Console (Investigation Tool, Email Log Search, Token Auditing) for phishing, BEC, and identity investigations.
Hands-on experience with industry-leading security tools across EDR, SWG, SIEM, and MDM platforms.
Solid understanding of network protocols, traffic flow, and the OSI model.
Experience with log analysis, malware triage, and digital forensics.
Proven track record of operating autonomously during incidents with minimal supervision.
Practical experience leveraging AI tools, LLMs, or agentic workflows to assist analysis, scripting, or automation.
Working ITIL knowledge and functional familiarity with the MITRE ATT&CK framework.
Courteous, articulate, and educated in interpersonal delivery. Maintains a polite, respectful, and calm demeanor with internal teammates, leadership, and external clients even during incident bridges.
Ability to confidently and politely present findings to technical and non-technical stakeholders.
Self-directed, resourceful, and critical thinker with proactive problem-solving instincts.
Strong personal anxiety management and self-organisation during high-pressure incidents.