Security L2 Analyst

Real threats. Real ownership. Real impact.

Not just forwarding alerts. Not just passing incidents to someone else.

NN Digital Hub’s Cyber Defense Core team protects millions of customers worldwide. We’re looking for a Security L2 Analyst who wants to be right where cyber defense happens - investigating threats, strengthening detections, and helping shape how our CDC works.

If you know what it means to take ownership of an incident, dig into the root cause, and help your teammates grow along the way, you’ll fit right in.

A note on shifts: Our services run 24/7, so continuous monitoring is part of the job. This role includes night and weekend shifts. With a large team and a reasonable approach to planning, we keep the schedule manageable and fair.

The day-to-day: what you’ll actually be doing

• ​Investigate and respond to advanced security incidents across a global environment, owning them end to end, from the first alert to resolution.
• ​Operate and fine-tune security tools, including SIEM, EDR, NDR, and IDS/IPS.
• ​Work across AWS and Azure cloud environments.
• ​Propose and implement improvements to detection logic, playbooks, and CDC processes.
• ​Take part in threat hunting, purple teaming exercises, and other CDC security projects.
• ​Mentor junior analysts and help improve the overall maturity of our CDC.

You’ll have autonomy, trust, and space to influence how we do things, not just follow existing runbooks.

What makes this a good place to work

• ​Real cybersecurity: Meaningful incidents to investigate, not just an endless stream of alert noise.
• ​Room to learn and grow: Support for certifications, training, and continuous development.
• ​Hybrid working that works: A strong home office culture, flexible time off, and a setup where you can work from home most of the time. We meet in the office once a week.
• ​People-first team: Down-to-earth colleagues, open communication, and no unnecessary formalities. No ego, no blame. Just real support.
• ​The tools you need: A company laptop and iPhone with a fully paid plan.
• ​Benefits that add up: Cafeteria up to 20,000 CZK, pension contributions, a MultiSport card, meal allowance, a discount on life insurance, and a contribution to home office expenses.
• ​Referral bonus: Up to 60,000 CZK for bringing new colleagues on board.
• ​Onboarding built around you: More in-person support during your probation period to help you settle in.

What you’ll bring

We’re not looking for a unicorn. We’re looking for a solid blue team professional with:

• ​2-4 years of experience in SOC, Blue Team, or Incident Response.
• ​Hands-on incident handling experience - more than copying findings into a ticket and sending them to a customer.
• ​An analytical approach: Take ownership of an incident, form a hypothesis, validate it, take response actions, escalate when needed, and document your work as you go.

Extra points if you also bring:

• ​A solid understanding of networking (OSI/TCP/IP), Windows and Linux internals, and Active Directory security.
• ​Practical experience with MITRE ATT&CK and the Kill Chain.
• ​Daily experience with tools such as Splunk, Microsoft Sentinel, Defender, CrowdStrike, Darktrace, Suricata, or similar.
• ​Basic scripting skills in Python, PowerShell, or Bash.
• A university degree or certifications are welcome, but not mandatory. Practical experience matters most.

From your application to an offer

First, we’ll review your CV to see how your experience matches the role. If it looks like a fit, we’ll arrange a short technical pre-screen with a couple of our senior colleagues. Next comes a longer in person interview with the team manager and Veronika from HR and then team members, where we’ll explore technical topics in more depth. If everything clicks, you’ll have a final short chat with our CDC manager. And if that goes well too, we’ll be excited to welcome you to the team!