SOC Specialist

As a SOC Specialist at SCRYPT, you will build, operate, and mature detection and response capabilities from the ground up within a lean security team at an institutional crypto trading firm. Working directly with the CISO, you will design detection logic, respond to real incidents, integrate log sources, manage escalations, and shape the security posture of a fast-moving organization operating under Swiss regulatory standards. This is a high-autonomy position requiring ownership from week one and the ability to investigate, build, and improve rather than passively monitor.

What you'll do

• Monitor, analyze, and investigate security events across Microsoft Sentinel (SIEM) and Defender XDR
• Lead incident response activities end to end including triage, investigation, containment, eradication, and post-incident review
• Write, tune, and optimize KQL-based detection rules and analytic use cases
• Onboard and maintain log sources to ensure visibility across endpoints, identity, cloud, and network layers
• Own alert escalation workflows and ensure timely, accurate handoff to relevant stakeholders
• Map attacker behavior to the MITRE ATT&CK framework and drive threat-informed detection
• Conduct proactive threat hunting based on hypotheses, intelligence feeds, and environmental signals
• Build and improve SOC automation workflows to reduce alert fatigue and accelerate response
• Develop and maintain SOC playbooks, runbooks, and escalation procedures
• Translate technical findings into clear communication for executive and non-technical audiences
• Collaborate closely with IT, DevOps, and engineering teams to strengthen the overall security posture

What you bring

• Minimum 3 years of hands-on experience in a SOC environment
• Proven, deep expertise with Microsoft Sentinel (Azure Sentinel) as a primary SIEM platform
• Strong proficiency in Microsoft Defender XDR
• Advanced KQL skills including detection rule authoring, query optimization, and custom analytics
• Solid experience with log source integration covering onboarding, parsing, normalization, and troubleshooting ingestion pipelines
• Demonstrated ability to lead or independently execute incident response investigations
• Strong understanding of the MITRE ATT&CK framework and modern adversary techniques
• Experience managing alert escalation processes and communicating findings under pressure
• Working knowledge of information security frameworks such as ISO 27001 or NIST
• Fluent English with clear, professional written and verbal communication

Nice to have

• Experience with SOC automation using SOAR platforms, Logic Apps, or custom scripting
• Background in crypto, fintech, or regulated financial services environments
• Familiarity with Swiss or EU regulatory frameworks such as DORA, FINMA, or MiCA
• Threat intelligence integration and operationalization experience

What we offer

• Build the SOC from the ground up with real ownership and impact
• Work directly with the CISO in a lean, expert-level security team
• Exposure to institutional crypto OTC trading with a unique threat landscape and complex, high-stakes operations
• Hybrid role based in Malta with flexibility within European hours

About SCRYPT

SCRYPT is a multi-jurisdictional licensed platform headquartered in Switzerland where money moves across borders and currencies, on-chain and off. One platform brings together payments, trading, custody and asset management, connecting stablecoin and fiat rails for institutions that move money at scale, supported by a human desk running 24/7.