Nov 2025 — Present · Madrid · Hybrid

SOC analyst in a 24/7 environment, managing and analyzing security incidents for multiple clients. Technical reference within the SOC, supporting N1 analysts.

• Detect, triage and respond to security alerts for a multi-client SOC operating 24/7.
• Work across major SIEM platforms: Microsoft Sentinel, RSA NetWitness, Splunk ES, ArcSight, QRadar, Google SecOps, XSIAM, McAfee, Akamai and NG SIEM.
• Investigate endpoints using EDR/XDR solutions: Microsoft Defender for Endpoint, Cortex XDR, CrowdStrike Falcon and Cytomic.
• Monitor OT/ICS environments with Nozomi Networks.
• Act as technical reference for the SOC, supporting N1 analysts and escalating complex cases.

• Microsoft Sentinel
• Splunk ES
• QRadar
• Google SecOps
• Microsoft Defender
• CrowdStrike Falcon
• Cortex XDR
• Nozomi
• ServiceNow

Apr 2025 — Oct 2025 · Madrid · Remote

SOC analyst investigating and analyzing security alerts for multiple clients, supporting containment, eradication and recovery of incidents.

• Investigated and analyzed security alerts for multiple clients in a managed SOC.
• Supported incident containment, eradication and recovery processes.
• Produced detailed incident documentation for clients.

• IBM QRadar
• CrowdStrike Falcon
• Cortex XDR
• Trend Micro
• OTRS

Apr 2024 — Apr 2025 · Madrid · Hybrid

Cybersecurity analyst focused on data analysis and reporting, with hands-on experience across a wide range of SIEM and EDR platforms.

• Produced data reports, analyzing and processing collected data with charts and tables.
• Operated SIEM platforms: Azure Sentinel, RSA NetWitness, McAfee, Splunk Enterprise Security, ArcSight, CheckPoint Harmony and AlienVault.
• Handled EDR solutions: Microsoft Defender ATP, Cytomic, Cortex XDR and CrowdStrike Falcon.
• Managed tickets through ServiceNow and Lucia.

• Azure Sentinel
• Splunk ES
• ArcSight
• McAfee
• Microsoft Defender
• CrowdStrike Falcon
• ServiceNow