Cybersecurity SOC Analyst

At Kognitiv Inc., we’re redefining what it means to be a Workday partner. As one of the fastest-growing companies in the ecosystem, we bring deep expertise, innovative thinking, and a people-first mindset to everything we do. We’re not just building better Workday solutions—we’re building a company where talented people thrive.

Ready to do your best work? Join us.

About the Role
Kognitiv is hiring a Cybersecurity SOC Analyst to investigate security alerts, improve detection rules and monitor how sensitive data moves across our environment. You'll support Kognitiv globally, adding European time-zone coverage alongside our North American security coverage.

This is a hands-on security operations role. Your focus will be working with our security information and event management (SIEM) platform and data loss prevention (DLP) tools, rather than leading audits, managing identity and access, or owning security strategy. You'll report to Ousmane Ndiaye and work closely with him on day-to-day security operations.

What You'll Do

Monitor, triage and investigate security alerts in Rapid7 InsightIDR, bringing together logs from firewalls, endpoints and other devices, and help mitigate verified security incidents.
Write and tune detection rules that correlate events across sources, including endpoint detection and response signals from SentinelOne. Identify opportunities to automate triage and reduce manual effort.
Review DLP events in Cyberhaven to identify potentially inappropriate movement of client or company data, including transfers to personal email or AI platforms.
Follow up with colleagues and their managers to understand flagged activity and investigate potential security concerns.
Apply your understanding of the technology being protected to distinguish suspicious behavior from expected activity.
Track emerging threats, malware and cloud vulnerabilities, and contribute findings to incident response playbooks and detection improvements.

What You'll Bring

Hands-on SOC analyst experience investigating alerts and working with SIEM platforms. We're targeting experience typically gained over 2-4 years; this is not an entry-level role or an upper limit on experience.
Practical experience with Rapid7, Splunk, Microsoft Sentinel or another SIEM. You should be able to explain how you've used the platform in real investigations; prior Rapid7 experience is not required.
Experience working with DLP tools and investigating potential data loss or inappropriate data transfers.
Querying, scripting or programming skills you can apply to security analysis and detection rules. Experience with LEQL, KQL, SPL or Python is relevant; you don't need to know all of them.
A broad understanding of IT systems, network protocols and cloud architectures, gained through a relevant technical degree or equivalent industry experience.
Practical experience with endpoint detection and response (EDR) tools alongside your SIEM and DLP work.
A methodical approach to active investigations and careful attention to log data, network traffic and subtle indicators of compromise.
Curiosity and a willingness to keep learning as threats, vulnerabilities and attacker tactics evolve.

Nice to Have

Experience with Rapid7, Cyberhaven or SentinelOne.
Familiarity with MITRE ATT&CK or CIS Controls to support your analysis.
Security+, CySA+, a relevant Splunk security certification or Rapid7 InsightIDR Certified Specialist. Certifications are helpful, not mandatory.
SIEM engineering or log-platform configuration experience.

Location and Working Hours
This role is intended to be based in Europe and supports Kognitiv globally. You'll generally work regular hours in your local time zone, with occasional later meetings to collaborate across regions. Visa sponsorship is not available.

Kognitiv is an Equal Opportunity Employer: All applicants will receive consideration for employment without regard to age, ancestry, color, family or medical care leave, gender identity or expression, genetic information, marital status, medical condition, national origin, physical or mental disability, political affiliation, protected veteran status, race, religion, sex (including pregnancy), sexual orientation, or any other characteristic protected by applicable laws, regulations and ordinances. Kognitiv will consider for employment qualified applicants with arrest or conviction records in a manner consistent with the requirements of the law, including any applicable fair chance law.

Work Authorization: Applicants for employment in the country in which they are applying (Employing Country) must have work authorization that does not now or in the future require sponsorship of a visa for employment authorization in the Employing Country and with Kognitiv.

Recruitment Fraud Alert: Kognitiv Inc. will only contact job applicants via official email addresses ending in @kognitivinc.com or through our official Workday candidate portal. While our team may occasionally reach out by phone during the recruitment process, we will never ask candidates for money, banking details, or sensitive personal information as a condition of employment. Please ensure you are communicating through our official channels.

Candidates who are currently employed by a client of Kognitiv or an affiliated Kognitiv business may not be eligible for consideration.

Estimated Application Deadline

This job postings' application deadline is an estimate, but ultimately the fill date is flexible and the job will remain open until filled. Any updates on deadlines will be communicated through this job posting.

2026-12-05

About Us

The founders and consultants of Kognitiv live and breathe Workday®. We understand that going live with your new system is just the first step in a long partnership with Workday® and its ecosystem. Implementations are fast and furious, with work like reports, dashboards, and knowledge transfer often postponed until after a go-live. In some cases, your implementation partner has already moved on to its next project. This is why Kognitiv exists: to bridge the gap for those clients wanting to better maintain and enhance their system post a go-live.