Mid SOC Analyst

Wrike is the most powerful work management platform. Built for teams and organizations looking to collaborate, create, and exceed every day, Wrike brings everyone and all work into a single place to remove complexity, increase productivity, and free people up to focus on their most purposeful work.

Wrike is our people, not a place. As a distributed team, we own our growth, stay globally connected, and rely on the product we build to deliver impactful work alongside brilliant minds. You'll have real ownership over meaningful work, a global team that has your back, and the flexibility to do your best work your way. If that sounds like you, we'd love to hear from you.

• Our vision: A world where everyone is free to focus on their most purposeful work, together.

• About the Role:

With flexible, distributed-first ways of working, you'll have the support to do your best work, wherever you are. Wrike commits to its customers that their data is monitored around the clock. Our Security Operations Center delivers on that promise through a hybrid model with a 24/7 managed detection partner (Rapid7)—and our analysts are the core drivers who handle escalations, conduct deep-dive investigations, and execute immediate action.

As an

L2 SOC Analyst

, you will play a pivotal role in our security rotation: monitoring and triaging security alerts, responding to escalations from our MDR partner, investigating incidents end-to-end, and continuously maturing our detection capabilities to protect Wrike and our customers.

• Your Impact:

• Alert Triage & Escalation: Monitor, triage, and investigate security alerts and events, including direct escalations from our 24/7 MDR partner (Rapid7).

• Incident Containment & Forensics: Assess risk and impact of potential incidents, conducting end-to-end investigations (log analysis, endpoint forensics, scoping) and taking swift remediation actions.

• On-Call Coverage: Participate in the SOC on-call rotation to guarantee round-the-clock escalation coverage.

• Detection Engineering & Tuning: Continuously refine and tune detection rules to minimize false positives and identify genuine threats faster.

• Proactive Threat Hunting: Contribute to threat hunting initiatives across endpoints, identity providers, SaaS platforms, and cloud environments.

• Process Improvement: Help document, refine, and optimize SOC playbooks, runbooks, incident reports, and operational escalation workflows.

• Your Qualifications:

• Experience: 2–3+ years of hands-on experience in a SOC or security monitoring environment (alert triage, incident investigation, and response).

• Technical Proficiency: Hands-on experience with SIEM platforms (Rapid7 InsightIDR or similar) and EDR/antimalware tooling for endpoint investigations.

• Core Knowledge: Strong understanding of network security fundamentals, common threat vectors, and attack frameworks (MITRE ATT&CK).

• Problem-Solving & Communication: Sharp logical thinking and analytical skills paired with advanced written and verbal English communication abilities.

• Availability: Ability and willingness to participate in an on-call rotation, including occasional nights and weekends.

• Standout Qualities:

• Hybrid Model Experience: Prior experience collaborating directly with an MDR or MSSP partner in a hybrid SOC environment.

• Extended Tooling Expertise: Hands-on familiarity with tools such as Splunk, Wazuh, Microsoft Defender for Endpoint, Crowdtrike, Okta, Google Workspace, AWS, or GCP.

• Advanced Capabilities: Previous experience in active threat hunting, detection engineering, or task automation using Python/Bash.

• Industry Certifications: Relevant security certifications (e.g., Security+, CySA+, GCIH, GCDA, or vendor-specific certifications).

• Team Dynamics:

You will join a highly collaborative, vigilant, and supportive Security Operations Center team. In this role, you will work closely with internal incident responders, cross-functional IT and infrastructure teams, and directly alongside analysts from our 24/7 MDR partner (Rapid7). The team culture values transparent communication, continuous learning, and collective ownership of security outcomes.

• Our Work Style:

We operate in a dynamic, hybrid security model utilizing modern cloud-first security tooling.

• Tech Stack & Tools: Rapid7 InsightIDR, EDR/XDR platforms, Okta, Google Workspace, AWS/GCP, and custom Python/Bash automation scripts.

• Methodologies: Framework-driven incident response aligned with MITRE ATT&CK, structured playbooks, and continuous threat-hunting cycles.

• What Makes Us Different: Unlike traditional SOC environments burdened by endless repetitive alerts, our hybrid model leverages an MDR partner to offload initial noise. This allows our L2 Analysts to focus on complex investigations, high-impact threat hunting, and genuine detection engineering.

• Benefits & Perks:

• 18 calendar days of paid vacation
• 12 days of National & Festival holidays (10 fixed, 2 flexible)
• Sick Leave Compensation (5 Paid Uncertified Sick Days)
• Menstrual Leave: Twelve (12) days per calendar year. Women employees are eligible for up to 1 day of menstrual leave per month.
• Parental Leave: 26 Weeks Maternity / 4 Week Paternity
• 2 Volunteer Days
• Group Medical Insurance (Employees + Dependents)
• Term Life Insurance (Rs 50,00,000)
• Personal Accident Insurance (Rs 50,00,000)
• Monthly Broadband / Internet Reimbursement (INR 1500)
• Hybrid Working Model + Complimentary Lunch & Snacks

Your recruitment buddy will be Nandini Singh, Recruiter.

#LI-NS2

Who Is Wrike and Our Culture

We’re a team of innovators and creators who solve the complex work problems of today and tomorrow.

Hybrid work mode

Wrike is our people, not a place. With 1,000+ employees collaborating across nearly every time zone, we support talent through 10 global hubs — Australia, Costa Rica, Cyprus, Czechia, Estonia, France, India, Ireland, Japan, and the United States — offering flexible ways of working that include remote work, hybrid environments, and co-working spaces across many locations.

While flexibility looks different across teams and regions, employees located near certain hubs — particularly in Prague (CZ), Nicosia (CY), Bangalore (IN), and Rennes (FR) — are generally expected to collaborate in person around 2–3 days per week, balancing the flexibility of distributed work with opportunities for in-person collaboration and connection.

Our persona

• 💡 Smart: We love what we do, and we’re great at it because this is our domain. Our combined knowledge in this space is unmatched.

• 💚 Dedicated: We get up every day focused on helping our customers win. We’re committed to helping our teammates win, too!

• 🤗 Approachable: We're friendly, easy to get along with, considerate, and helpful.

Our culture and Values

🤩 Customer-Focused

We care about our customers.

We understand the customer journey, experience, and value derived from Wrike. Decision-making and action-taking are done with the customer in mind.

🤝 Collaborative

We work as and win together,

each bringing unique strengths that contribute to diversity of thought for better outcomes. Leveraging our own work management platform, we foster an environment of creative collaboration and shared achievement.

🎨 Creative

We strive to succeed through continuous innovation.

It’s our pursuit of novel concepts that helped us create a market category. We continue to cultivate a workplace that fosters creative thinking as a means of transcending conventional boundaries and empowers us to break new ground to deliver extraordinary work management solutions.

💪 Committed

We believe in ownership at all levels of the organization,

by owning workflows from start to finish. Each member of our team is an integral part of this commitment, establishing work as a platform for personal growth and transformation, as well as collective success and growth.

Check out our LinkedIn Life Page, Company culture page, Instagram, Wrike Engineering Team, Medium, , Youtube for a feel for what life is like at Wrike.

• 2–3+ years of hands-on experience in a SOC or security monitoring environment (alert triage, incident investigation, and response)
• Hands-on experience with SIEM platforms (Rapid7 InsightIDR or similar)
• Hands-on experience with EDR/antimalware tooling for endpoint investigations
• Strong understanding of network security fundamentals, common threat vectors, and attack frameworks (MITRE ATT&CK)
• Sharp logical thinking and analytical skills
• Advanced written and verbal English communication abilities
• Ability and willingness to participate in an on-call rotation, including occasional nights and weekends
• Prior experience collaborating directly with an MDR or MSSP partner in a hybrid SOC environment
• Hands-on familiarity with tools such as Splunk, Wazuh, Microsoft Defender for Endpoint, CrowdStrike, Okta, Google Workspace, AWS, or GCP
• Previous experience in active threat hunting, detection engineering, or task automation using Python/Bash
• Relevant security certifications (e.g., Security+, CySA+, GCIH, GCDA, or vendor-specific)