Security Analyst

Company Overview At Motorola Solutions, we believe that everything starts with our people. We’re a global close-knit community, united by the relentless pursuit to help keep people safer everywhere. We build and connect technologies to help protect people, property and places. Our solutions foster the collaboration that’s critical for safer communities, safer schools, safer hospitals, safer businesses, and ultimately, safer nations. Connect with a career that matters, and help us build a safer future. Department Overview The Cyber Security Team protects Nødnett by enabling early detection of threats and vulnerabilities and supporting effective incident response. The team operates a hardened, segmented on-prem security environment for monitoring, investigation and incident response support, in close cooperation with Operations/NOC, external SOC partner(s), and the network owner (DSB). Job Description Perform log analysis and investigation in SIEM tooling (Splunk), including timeline building and extraction of relevant indicators. Perform endpoint triage and analysis using EDR tooling to validate suspected compromise and support containment decisions. Enrich investigations with threat intelligence and IOC context; maintain a structured record of findings and assumptions. Support incident response with evidence-friendly collection steps and documentation; contribute to containment, eradication and recovery activities under guidance. Conduct playbook-driven threat hunting (basic), and document results and follow-ups. Support vulnerability handling with triage, severity context (CVSS), coordination and tracking of remediation/mitigations. Maintain case quality: clear tickets, timely updates, and clean handovers to engineers, NOC, external SOC, or CSIRT. Contribute to continuous improvement: reduce recurring false positives, improve playbooks/runbooks, and propose small detection and process improvements. Basic Requirements Education and experience: Relevant technical degree or equivalent competence. Early-career profile; relevant experience from SOC/NOC/operations/helpdesk is an advantage. Monitoring and investigation competence (expected): Solid understanding of networking basics (TCP/IP, DNS, HTTP, routing concepts) and how this appears in logs and investigations. Basic Linux and Windows administration understanding (what “normal” looks like; how to collect basic evidence and context). Good understanding of security controls (firewalls, proxies, VPN) and how they impact containment and investigation. Strong log management and log analysis ability, including structured search, correlation, and interpretation in a SIEM. Familiarity with endpoint telemetry and investigation workflows using EDR (alert → triage → validate → contain). Understanding of incident lifecycle and disciplined incident handling and escalation. Working knowledge of threat intelligence and IOC handling; familiarity with mapping activity to adversary techniques (e.g., MITRE ATT&CK as a common reference). Basic scripting for analyst workflows (e.g., parsing, enrichment, small automation tasks) and disciplined note-taking. Tools/technology (expected practical exposure): Splunk for investigation and log analysis. Vendor case portal workflows for support and escalations. Ticketing/case handling and structured documentation (internal tooling). Exposure to EDR tooling and endpoint triage concepts. Soft-skills: Curious and analytical; uses evidence and makes uncertainties explicit. Calm and structured under pressure; follows playbooks and escalates early when needed. Strong written documentation habits; concise status updates and handovers. Collaborative; works closely with Security Engineers, Operations/NOC and external SOC partner(s). Language Skills: Fully fluent in Norwegian and English (spoken and written). Security clearance and authorisation: Norwegian security clearance at HEMMELIG (Secret) level before accession. Authorisation: BEGRENSET (RESTRICTED) as require ... (truncated, view full listing at source)