Type: Contract, 6 months (extension possible) · Department: Security Services · Location: Remote (Sri Lanka-based candidates only)

About the role

Arozen is hiring two experienced Security Analysts to join our international Managed Security Services SOC, supporting one of our long-standing MSP clients. You'll safeguard client environments by proactively detecting, investigating, and responding to security incidents in a 24/7 operation. This is a hands-on L2/L3 role for analysts who can own an alert from triage through containment.

What you'll do

• Monitor, triage and investigate security alerts across multiple client environments, assessing severity and validity
• Lead containment, eradication and recovery actions for security incidents
• Maintain detailed incident records and clear timelines
• Run regular vulnerability assessments and drive remediation with client teams
• Maintain and tune security toolsets within a Managed Security as a Service (MSaaS) offering
• Communicate clearly with internal teams and client stakeholders during and after incidents
• Follow client-specific security policies and contribute to improving SOC processes and playbooks
• Stay current on emerging threats and feed that into better detections and practices

What you bring

• 3+ years in a SOC / Security Analyst role, ideally within an MSP or 24/7 environment
• Proven, hands-on incident response experience (not just alert monitoring)
• Experience with SIEM, threat intelligence and security analytics
• Working knowledge of firewalls, IDS/IPS, AV/EDR, authentication systems, log management and content filtering
• Solid understanding of networks, workstations and servers
• Clear written and spoken English; comfortable dealing directly with international clients
• Calm, methodical problem-solver under pressure; works well independently and in a team
• Bachelor's degree in Cybersecurity, Information Security or a related field

Strongly preferred

• CrowdStrike Falcon (AV/EDR): investigation, response actions, RTR
• Sumo Logic (SIEM): searches, dashboards, alert tuning
• Certifications such as CompTIA Security+, CySA+, GCIH, CISSP, or CrowdStrike CCFA/CCFR

Engagement details

• 6-month contract with possibility of extension
• Fully remote; must be based in Sri Lanka
• Shift-based work supporting a 24/7 SOC
• Reliable high-speed internet and a quiet, secure workspace required
• Immediate or short-notice start preferred

To apply: submit your CV along with a short note describing one incident you personally handled: what you found, what you did, and the outcome.