Cyber Security Analyst

About the role

Rozmith, a security-first managed IT and cybersecurity partner for insurance, financial services and other regulated firms across the US, UK and Europe, is hiring a Cyber Security Analyst. You will monitor client environments through Microsoft Sentinel, Defender XDR, CrowdStrike, SentinelOne and email security tools, investigate alerts and close them out before they become incidents. The role is hybrid, with the office in Skopje and remote work, and overlaps with US Eastern business hours.

Key responsibilities

• Monitor and triage alerts from Microsoft Sentinel, Defender XDR, CrowdStrike Falcon, SentinelOne, Abnormal Security and Mimecast
• Correlate sign-in, endpoint, mailbox and network events in KQL to build a timeline of what happened
• Investigate phishing, account compromise, suspicious sign-ins and malware end to end
• Run first-line containment from runbooks: disable accounts, revoke sessions, isolate devices, purge messages
• Hand confirmed incidents to engineers with evidence, scope and recommended next steps
• Review Tenable vulnerability results and Axonius asset gaps, and track fixes to closure
• Tune detection rules to reduce noise and catch real threats sooner
• Gather audit evidence in DigitalXForce for frameworks such as SOC 2
• Write incident reports in plain language for clients

Required profile

• 1-3 years in a SOC, security operations or IT operations role
• Methodical approach: documenting findings and following them through
• Clear written English
• Nice to have: MSP or multi-tenant SOC experience, regulated environments and frameworks such as SOC 2, GDPR, NIS2 or DORA

Required skills

• Hands-on use of a SIEM and an enterprise EDR (Sentinel, CrowdStrike, SentinelOne or Defender for Endpoint)
• Basic KQL to search logs and build timelines
• Solid networking fundamentals: TCP/IP, DNS, HTTP, VPNs and firewalls
• Working knowledge of Windows, Active Directory, Entra ID and Microsoft 365 security
• Understanding of common attack techniques and MITRE ATT&CK
• Nice to have: FortiGate/FortiAnalyzer, Palo Alto or Cisco experience; certifications such as Security+, CySA+, SC-200 or CrowdStrike CCFR

What we offer

• Hybrid working model, shared after-hours on-call rotation
• Company laptop, paid certification prep and exam vouchers