SOC Analyst (WAAP)

Gcore WAAP protects customer web applications and APIs against DDoS bots and application-layer attacks at CDN edge scale. We are building out a proactive managed-support offering for enterprise customers and we need a SOC Analyst to run the day-to-day security operations: watch traffic and alerts triage false positives prepare customer-facing threat reports and escalate real impact to the right team. You will work alongside our Threat Researchers taking the operational load off them so they can focus on deep analysis. You do not need to be a threat-hunting expert.

You need to be reliable observant comfortable in logs and dashboards and able to tell an attack from legitimate traffic - and know when to escalate.

What You Will Do 

• Monitor WAAP and DDoS activity across customer accounts - dashboards alerts and traffic patterns - and recognize when something needs attention.
• Triage false positives: review traffic flagged by security policies confirm or dismiss and keep noise down for customers (this is a large daily part of the job).
• Prepare reports: weekly threat summaries per customer and post-incident DDoS reports in clear customer-facing English.
• Alert and escalate: when an attack is impacting a customer signal the engineering team or Support with the right context - e.g. a customer needs to be tagged or a policy adjusted - and follow the escalation runbook.
• Support customer onboarding: apply standard security configuration based on the customers profile (resource type traffic volume legitimate-traffic exclusions) following playbooks.
• Follow the reaction-time SLA - our commitment to customers is speed of reaction and clear post-incident reporting not a prevention guarantee.
• Contribute to and maintain runbooks so responses are consistent and repeatable.

Qualifications :

What We are Looking For

• Understanding of web security fundamentals: WAF DDoS bots OWASP Top 10.
• Solid basics in HTTP TCP/IP TLS.
• Comfortable analyzing logs and reading dashboards; can spot anomalies in traffic.
• Able to distinguish malicious from legitimate traffic and reason about false positives.
• Clear written English for customer-facing reports.
• Reliable detail-oriented and calm under incident pressure.
• Willingness to work in a shift/on-call rotation.

Nice to Have

• Prior SOC L1/L2 or related experience.
• Basic query/scripting: SQL-like log queries regex a bit of Python.
• Familiarity with CDN/WAF platforms (Cloudflare Akamai Imperva F5 Radware).
• Exposure to SIEM / alerting tooling and PagerDuty-style on-call.
• Security certifications (e.g. CompTIA Security) - a plus not a requirement.

Explicitly NOT Required

• Deep threat research exploit development malware reverse-engineering. That work stays with our Threat Researchers - this role feeds them clean triaged signal and takes the routine off their plate.

Why This Role Matters

You become the first line of Gcore WAAPs managed security operations - the person who keeps customers informed and protected day to day and who lets our specialists focus on the hard problems. High visibility direct customer impact and a clear path to grow into threat research or detection engineering.

Additional Information :

Benefits

At Gcore we want you to do your best work and enjoy the journey. Our benefits are designed to support your growth well-being and life beyond work: 

• Competitive compensation 
• Flexible working hours and hybrid or remote options depending on your role 
• Work from anywhere in the world for up to 45 days per year 
• Private medical insurance for you and your family* 
• Extra paid vacation and sick leave days* 
• Support for lifes important moments and celebrations 
• Language courses to help you connect and grow 
• Modern welcoming offices with snacks drinks and entertainment* 
• Team sports and social activities* 

*Benefits may vary depending on your location. 

Equal Opportunity Employer 

We provide equal opportunity to all applicants without regard to race color religion sex sexual orientation age gender identity gender expression national origin disability or any other legally protected characteristics. 

Remote Work :

Yes

Employment Type :

Full-time