PbAbout Keyrockbr/bSince our beginnings in 2017, we’ve grown to be a leading change-maker in the digital asset space, renowned for our partnerships and innovation.brToday, we rock with over 200 team members around the world. Our diverse team hails from 42 nationalities, with backgrounds ranging from DeFi natives to PhDs. Predominantly remote, we have hubs in London, Brussels, Singapore and Paris, and host regular online and offline hangouts to keep the crew tight.brWe are trading on more than 80 exchanges, and working with a wide array of asset issuers. As a well-established market maker, our distinctive expertise led us to expand rapidly. Today, our services span market making, options trading, high-frequency trading, OTC, and DeFi trading desks as well as digital asset management. Keyrock is looking to expand and establish itself as a full-service financial institution through both organic innovation and inorganic growth.brBut we’re more than a service provider. We’re an initiator. We’re pioneers in adopting the Rust Development language for our algorithmic trading systems, and champions of its use in the industry. We support the growth of Web3 startups through our Accelerator Program. We upgrade ecosystems by injecting liquidity into promising DeFi, RWA, and NFT protocols. And we push the industry’s progress with our research and governance initiatives.brAt Keyrock, we’re not just envisioning the future of digital assets. We’re actively building it.brbRole Summarybr/bAs a SOC Analyst (Level 1), you are the first line of defense for monitoring, triaging, and escalating security alerts across Keyrock’s cloud-first, high-availability trading environment. You will follow playbooks/runbooks to validate alerts, enrich investigations with context, and ensure timely escalation to Level 2/Incident Response.brbWhat You’ll Do (Core Responsibilities)br/b /pulli24⁄7 monitoring and alert triage across SIEM/EDR/cloud security tooling; identify false positives vs. credible threats and set appropriate severity. /liliInitial investigation and enrichment: gather relevant logs/telemetry, add context, and document findings clearly in the case/ticketing system. /liliEscalation and coordination: escalate confirmed/suspected incidents quickly and cleanly to L2/IR with a complete handoff (timeline, scope, IOCs, actions taken). /liliRunbook execution: follow SOPs for common events (phishing, suspicious logins, endpoint detections, cloud key/token risk, malware alerts, data exfiltration signals), including containment actions you’re authorized to perform. /liliThreat-aware analysis: map alerts to adversary behaviors (e.g., MITRE ATTCK techniques) to improve understanding and escalation quality. /liliOperational hygiene: maintain accurate shift handovers, update watchlists and investigation notes, and identify recurring alert patterns for tuning recommendations.br/li /ulbWhat We’re Looking For (Minimum Qualifications)br/bulli0–2 years in a SOC / security monitoring / IT operations role (or equivalent hands-on experience, internships, labs). /liliPractical knowledge of security fundamentals: networking, DNS, HTTP(S), identity/authentication, and malware basics. /liliFamiliarity with log investigation and event triage concepts. /liliFamiliarity with common security tools and workflows (any of the following): SIEM (Splunk/Elastic/Sentinel), EDR (CrowdStrike/Defender), ticketing (Jira/ServiceNow), basic SOAR concepts. /liliStrong written communication: produce clear, escalation-ready tickets and timelines. /liliAbility to work rotating shifts/on-call (as required), including weekends/holidays depending on coverage model.br/li /ulbNice To Have (Preferred)br/bulliCloud security exposure (AWS/GCP/Azure): CloudTrail/Activity Logs, IAM analysis, detections for token/key misuse. /liliFamiliarity with incident response frameworks/processes (e.g., NIST incident response guidance). /liliExposure to detection engineering concepts (rule tuning, false-positive reduction), or basic scripting (Python/Bash) for investigation automation. /liliKnowledge of the digital-asset ecosystem (exchanges, custody concepts, operational risk in 24⁄7 trading environments). /liliCertifications (optional): Security+, Blue Team Level 1, SSCP, or equivalent practical training.br/li /ulbWhat Success Looks Like (First 60–90 Days)br/bulliConsistently accurate triage decisions with strong documentation and clean escalations. /liliReliable shift handovers and measurable reduction in re-opened or incomplete cases. /liliClear recommendations for detection/playbook improvements based on recurring patterns.br/li /ulbWhy Keyrockbr/bulliWork in a fast-moving, globally distributed environment shaping the future of digital financial markets. /liliA culture that expects ownership, learning, and continuous improvement. /li /ul