SOC Analyst

About MoonPay

MoonPay operates the infrastructure layer for moving value across crypto, stablecoins, and tokenized assets. The company serves over 30 million customers and 500+ ecosystem partners, providing four core services: fund, tokenize, trade, and spend. Licensed in the U.S. and regulated across the UK, EU, Canada, and Australia, MoonPay combines regulatory rigor with startup velocity. The company has been recognized as one of Forbes' America's Best Startup Employers 2026 and ranked second in Crypto Services on Fortune's inaugural Crypto 100 list.

MoonPay operates with high standards and real accountability. AI is embedded as the default operating mode across every role, handling routine work so you can focus on impact. The culture prizes outcomes over process, ownership over titles, and winning through collaboration.

The Opportunity

The Technology & Security Services team is hiring a SOC Analyst for the Security Operations Center in Bengaluru. This is a frontline security role working 24x7 on rotational shifts, protecting the organization against threats and operational disruptions. You'll monitor live alerts, investigate suspicious activity, respond to incidents, and support infrastructure operations. The pace is fast and you'll need to juggle multiple security and IT issues simultaneously while building expertise across both security and operational workflows.

Your Day-to-Day

You'll monitor real-time security alerts and hunt suspicious network, endpoint, and cloud activity using SIEM queries and threat-analysis tools. You'll investigate data-exfiltration indicators including unusual file transfers, large data volumes, and unauthorized cloud access. Email-based threats like phishing and malware fall under your scope, along with endpoint remediation through EDR and MDM workflows. You'll handle the first response to IT requests: password resets, account unlocks, hardware provisioning, and application access problems. Strong documentation matters here—you'll maintain accurate ticket notes, incident summaries, and contribute to runbooks and knowledge base improvements. You'll also monitor external attack surface for brand impersonation, fraudulent domains, and social-engineering threats, validating honeytoken decoys to detect lateral movement.

What You Bring

You have 2+ years hands-on experience in a SOC, security monitoring, or incident-response role with demonstrated ability to triage alerts and execute IR procedures. You understand IT infrastructure: networks (IP, DNS, ports, protocols), endpoints (macOS), and identity systems (IAM, SSO, MFA). You're familiar with incident-response frameworks like MITRE ATT&CK, incident-command models, and ticketing systems such as Jira or Linear. You're detail-oriented with strong documentation discipline, able to write clear incident summaries and shift notes. You think analytically and use sound judgment deciding when to escalate versus investigate further.

Nice to Have

Bachelor's degree in Cybersecurity, Computer Science, or Information Technology. Proficiency with Okta for SSO and user access management. Experience with Jamf for macOS device management. Exposure to Google SecOps, DoControl, Code42, or Cloudflare email security.

What We Offer

Competitive salary with an equity package for all employees. Pay-for-performance equity bonuses for outsized outcomes. Annual Moonshot awards: 20 employees receive $250,000 equity grants for exceptional impact. Employer pension contributions from day one. Employee referral program paying 10K USDC per successful hire. Flexible time off and an end-of-year company-wide recharge period. Birthday leave to celebrate yourself.