Reconomy

Tech-enabled circular economy solutions provider

Senior Security Operations Analyst

Security Operations & Incident ResponsePosted on Nov 11

Full-timeBucharest, RomaniaRON18.8k - RON22.2k /moHybrid

About the Job

Requirements

At least 5 years of experience in Security Operations, focused on incident management, investigation, and response.
Hands-on experience with SIEM platforms, preferably Microsoft Sentinel, including investigations, threat hunting, and workbooks.
Strong proficiency in KQL (Kusto Query Language) for security investigations, threat hunting, and detection gap analysis.
Experience leading complex security incident investigations and coordinating cross-functional incident response efforts.
Understanding of incident management frameworks and practices, including NIST, SANS, and ITIL.
Experience conducting post-incident reviews and translating findings into detection or security control improvements.
Understanding of cyber threats, attack techniques, threat actors, TTPs, and the MITRE ATT&CK framework.
Experience with security monitoring, threat detection, log analysis, and correlation across multiple data sources.
Hands-on knowledge of EDR, firewalls, IDS/IPS, and SIEM platforms.
Understanding of network protocols, operating systems, and security architecture.
Basic scripting and automation skills using PowerShell or Python.
Experience with ISO 27001 and SOC 2 compliance frameworks.
Previous technical leadership or mentoring experience in a 24/7 operational environment.
Strong analytical and problem-solving skills, with the ability to make decisions under pressure and communicate complex technical issues to non-technical stakeholders.
A bachelor's degree in Cybersecurity, Computer Science, IT, or a related field, or equivalent professional experience.
A relevant professional security certification, such as GCIH, CompTIA CySA+, CISSP, or an equivalent recognised certification.
Availability for rotational on-call escalation support, irregular hours during major security incidents, and collaboration with global teams across time zones.

Responsibilities

Lead complex security incident investigations using industry-standard incident management frameworks such as NIST and SANS.
Oversee the incident lifecycle from detection and investigation through containment, remediation, and lessons learned.
Coordinate cross-functional incident response during major security events, providing technical guidance and risk-based recommendations.
Lead post-incident reviews, conduct root cause analysis, and ensure lessons learned are implemented and tracked to closure.
Analyze incidents to identify detection, visibility, and control gaps, and translate findings into prioritized detection requirements for the Cyber Security Engineer.
Map detection use cases to the MITRE ATT&CK framework and identify opportunities to improve threat coverage.
Develop and maintain KQL queries for investigations, threat hunting, and detection gap analysis.
Collaborate with Security Engineering to prioritize detection improvements, identify telemetry gaps, and validate new or updated detections.
Improve detection accuracy, incident response effectiveness, and security operations processes.
Serve as the senior technical escalation point for Security Operations Analysts during complex investigations and critical security incidents.
Conduct proactive threat hunting using Microsoft Sentinel, SIEM platforms, and other security tools.
Apply threat intelligence and incident analysis to enhance monitoring and detection capabilities.
Identify opportunities for security automation and collaborate with Security Engineering to define response automation requirements.
Act as shift leader and senior point of contact during assigned periods, coordinating team activities during major incidents.
Ensure high-quality shift handovers, incident documentation, and investigation standards.
Develop and maintain incident response playbooks, detection requirement specifications, and investigation procedures.
Create training materials and maintain the team's knowledge base to promote security operations best practices.
Contribute to security architecture discussions, tooling decisions, and continuous improvement initiatives.
Provide timely updates to management and stakeholders on significant incidents, emerging threats, detection coverage, and lessons learned.
Coordinate with internal teams, external security partners, and vendors to support incident resolution.
Represent Security Operations in operational forums, security governance meetings, and technology initiatives.
Deliver incident reports and performance metrics, communicating complex technical issues to technical and non-technical audiences.

Desired Qualifications

Experience across incident response, threat hunting, digital forensics, and security architecture.
Experience with additional SIEM platforms such as Splunk, IBM QRadar, or Elastic.
Knowledge of cloud security monitoring across Azure, AWS, and Microsoft 365.
Experience with detection engineering, including SIEM analytics rule development, detection-as-code, and MITRE ATT&CK coverage mapping.
Familiarity with SOAR platforms and security orchestration and automation workflows, including Microsoft Sentinel playbooks, Logic Apps, and Azure Automation.
Experience with threat intelligence platforms, proactive threat hunting methodologies, and security tool implementation or optimization.
Knowledge of malware analysis, network forensics, and packet analysis tools such as Wireshark.
Advanced scripting, automation, and integration skills, or experience with reporting tools such as Power BI.
Exposure to red team or purple team exercises and security transformation projects.
Additional certifications such as Microsoft SC-200, GCFA, GREM, GNFA, CISM, CEH, or relevant SANS and cloud security certifications.
A master's degree in Cybersecurity or a related field.

RecoTek is Reconomy’s new centralized technology hub located in Bucharest, Romania, officially launched in February 2024. Serving as the backbone of Reconomy’s tech operations, it consolidates inhouse expertise across all Reconomy brands to accelerate platform development and enhance service delivery.

Reconomy is an international circular economy specialist that combines technology, skills and incredible people to enable businesses to better manage their resources, helping reduce waste, optimise their supply chains, and contribute in a meaningful way toward the circular economy

Reconomy is bending the edges of linear business models across the world, integrating circular economy strategies and processes into everyday operations. We have the tools, talent and technology that enable customers to harness the full and inherent value of their resources, with integrated global operations in over 80 countries across the world.

Reconomy’s full range of capabilities are organized into 3 ‘loops’: Recycle, Comply and Re-use, each providing opportunities for circularity within the wider resource cycle.

Recycle loop is utilising the latest technology and data to enable customers to make the best possible use of their materials.
Comply loop is enabling customers to solve increasingly complex environmental regulatory challenges using data, expert knowledge and thought leadership to drive business accountability across the globe.
Re-use loop is providing intelligent technology platforms and agile delivery models for pre-retail logistics and product returns, fulfilment and processing, on behalf of many of Europe’s largest retailers.

We are looking for an experienced and proactive Senior Security Operations Analyst to join Reconomy's Information Security team in Romania.

In this role, you will provide technical leadership in complex security incident investigations, drive excellence in incident management and response, and continuously improve our security detection capabilities. You will take ownership of the post-incident feedback process, identifying detection, visibility and control gaps and translating findings into actionable requirements for Security Engineering.

Working closely with the Cyber Security Engineer, technical teams and business stakeholders, you will lead incident response efforts, conduct proactive threat hunting and help strengthen our security operations through Microsoft Sentinel, KQL and the MITRE ATT&CK framework. You will also mentor Security Operations Analysts, act as a senior technical escalation point and contribute to the continuous development of our security operations capabilities.

This is an exciting opportunity to take on a senior technical leadership role within an international, technology-driven organisation operating in more than 80 countries, with opportunities for professional growth and career progression into technical specialist or management roles.

Advanced Incident Management & Response

Lead complex security incident investigations, applying industry-standard incident management frameworks (NIST, SANS).
Oversee the end-to-end incident lifecycle, from detection and investigation to containment, remediation and lessons learned.
Coordinate cross-functional incident response efforts during major security events, providing technical guidance and risk-based recommendations.
Lead post-incident reviews, conduct root cause analysis and ensure lessons learned are implemented and tracked to closure.

Detection Gap Analysis & Continuous Improvement

Analyse security incidents to identify detection, visibility and control gaps, translating findings into prioritised detection requirements for the Cyber Security Engineer.
Map detection use cases to the MITRE ATT&CK framework and identify opportunities to improve threat coverage.
Develop and maintain KQL queries for security investigations, threat hunting and detection gap analysis.
Collaborate with Security Engineering to prioritise detection improvements, identify telemetry gaps and validate new or updated detections.
Drive improvements in detection accuracy, incident response effectiveness and security operations processes.

Technical Leadership & Threat Hunting

Act as the senior technical escalation point for Security Operations Analysts during complex investigations and critical security incidents.
Conduct proactive threat hunting using Microsoft Sentinel, SIEM platforms and other security tools.
Apply threat intelligence and incident analysis to enhance monitoring and detection capabilities.
Identify opportunities for security automation and collaborate with Security Engineering to define response automation requirements.

Team Leadership & Mentoring

Act as shift leader and senior point of contact during assigned periods, coordinating team activities during major incidents.
Mentor and support Security Operations Analysts and Junior Analysts in investigation techniques, incident handling and response best practices.
Ensure high-quality shift handovers, incident documentation and investigation standards.
Support team development through training, knowledge sharing and constructive feedback.

Process Improvement & Knowledge Development

Develop and maintain incident response playbooks, detection requirement specifications and investigation procedures.
Create training materials and maintain the team's knowledge base, promoting security operations best practices.
Contribute to security architecture discussions, tooling decisions and continuous improvement initiatives.

Stakeholder Management & Reporting

Provide clear and timely updates to management and stakeholders on significant security incidents, emerging threats, detection coverage and lessons learned.
Coordinate with internal teams, external security partners and vendors to support effective incident resolution.
Represent Security Operations in operational forums, security governance meetings and technology initiatives.
Deliver incident reports and performance metrics, communicating complex technical issues effectively to both technical and non-technical audiences.

Essential requirements

5+ years of experience in Security Operations, with a strong focus on incident management, investigation and response.
Hands-on experience with SIEM platforms, preferably Microsoft Sentinel, including investigations, threat hunting and workbooks.
Strong proficiency in KQL (Kusto Query Language) for security investigations, threat hunting and detection gap analysis.
Proven experience leading complex security incident investigations and coordinating cross-functional incident response efforts.
Solid understanding of incident management frameworks and best practices, including NIST, SANS and ITIL.
Experience conducting post-incident reviews and translating findings into detection or security control improvements.
Strong understanding of cyber threats, attack techniques, threat actors and TTPs, including the MITRE ATT&CK framework.
Experience with security monitoring, threat detection, log analysis and correlation across multiple data sources.
Hands-on knowledge of security technologies, including EDR, firewalls, IDS/IPS and SIEM platforms.
Understanding of network protocols, operating systems and security architecture.
Basic scripting and automation skills using PowerShell or Python.
Experience with ISO 27001 and SOC 2 compliance frameworks.
Previous experience in technical leadership or mentoring within a 24/7 operational environment.
Strong analytical, problem-solving and communication skills, with the ability to make decisions under pressure and communicate complex technical issues to non-technical stakeholders.
Bachelor's degree in Cybersecurity, Computer Science, IT or a related field, or equivalent professional experience.
Relevant professional security certification, such as GCIH, CompTIA CySA+, CISSP or an equivalent recognised certification.
Availability to provide rotational on-call escalation support, work irregular hours during major security incidents and collaborate with global teams across different time zones.

Nice to have

Experience across multiple security domains, including incident response, threat hunting, digital forensics and security architecture.
Experience with additional SIEM platforms such as Splunk, IBM QRadar or Elastic.
Knowledge of cloud security monitoring across Azure, AWS and Microsoft 365.
Experience with detection engineering, including SIEM analytics rule development, detection-as-code and MITRE ATT&CK coverage mapping.
Familiarity with SOAR platforms, security orchestration and automation workflows, including Microsoft Sentinel playbooks, Logic Apps and Azure Automation.
Experience with threat intelligence platforms, proactive threat hunting methodologies and security tool implementation or optimisation.
Knowledge of malware analysis, network forensics and packet analysis tools such as Wireshark.
Advanced scripting, automation and integration skills, or experience with reporting tools such as Power BI.
Exposure to red team/purple team exercises and security transformation projects.
Additional certifications such as Microsoft SC-200, GCFA, GREM, GNFA, CISM, CEH or relevant SANS and cloud security certifications.
Master's degree in Cybersecurity or a related field.

About the Company

Reconomy

Tech-enabled circular economy solutions provider

Reconomy helps businesses create circular economy loops by combining tech-enabled tools with skilled people to manage resources, reduce waste, and optimize supply chains. Its approach uses digital tracking of materials and waste, paired with on-the-ground services to design and operate reuse, recycling, and remanufacturing loops. It differentiates itself through a mix of software and hands-on service, international experience, and a focus on practical, end-to-end circular solutions rather than generic waste services. The goal is to close material loops, lower costs, reduce emissions, and advance wider adoption of the circular economy.

Company size: 201-500
Company stage: Acquired
Total funding: Not listed
Headquarters: Corby, United Kingdom
Founded: 1994

Recently Posted Jobs

Explore more opportunities at Reconomy

See more jobs