Job Summary
Grant Thornton's Cyber Fusion Centre (CFC) is looking for a technically strong, motivated SOC Analyst to join a follow-the-sun security operations team. This is a hands-on role covering continuous monitoring, alert triage, incident investigation, threat analysis, incident response support, remediation coordination, documentation, and ongoing improvement of detection and response capability.
The CFC operates a tierless SOC model — analysts own the full security operations lifecycle, from initial alert review and triage through investigation, containment support, escalation, documentation, closure, and improvement recommendations.
The primary platform is CrowdStrike Falcon Next-Gen SIEM. Analysts should be comfortable querying and analyzing security data, interpreting detections, correlating events across data sources, assessing suspicious or malicious activity, contributing to investigations, using dashboards and case management tools, and producing clear reporting.
Responsibilities
Security Monitoring & Alert Triage




· Use CrowdStrike Falcon Next-Gen SIEM as the primary platform for real-time monitoring, query-based analysis, detection review, event correlation, case management, and reporting.
· Review, prioritize, and classify alerts using the established severity matrix and SOC operating procedures.
· Determine whether alerts represent false positives, benign activity, suspicious activity, policy violations, or potential security incidents.
· Conduct triage, detailed investigation, evidence review, response coordination, and closure documentation for assigned alerts and incidents.
· Analyze and interpret first-party detections, third-party detections, and correlation rule outputs.
· Maintain accurate triage decisions, evidence notes, and investigation updates in the incident management platform.
Incident Response & Remediation
· Ensure incidents are handled promptly in line with SOC runbooks, escalation workflows, and operational expectations.
· Execute

📌 SOC Analyst (Bogotá)
🏢 Auxis
📍 Bogotá