Cybersecurity Incident Response Analyst

A Cybersecurity Incident Response Analyst is needed to join the Security Operations Centre of a global financial services organisation, helping to detect, investigate, contain and resolve cybersecurity incidents across the EMEA region.

You will be responsible for:

• Monitoring and analysing alerts from SIEM, EDR/XDR, identity, email, cloud and network controls to identify suspicious or malicious activity.
• Triaging alerts, validating incidents, assessing severity and business impact, and escalating in line with defined processes and service levels.
• Leading or supporting investigations into phishing, malware, account compromise, data loss, unauthorised access and suspicious network activity.
• Coordinating containment, eradication and recovery with infrastructure, application, identity, cloud and business teams.
• Maintaining case records, investigation timelines, evidence and decision logs.
• Collecting, preserving and analysing endpoint, server, identity, network, email and cloud artefacts.
• Identifying indicators of compromise and threat actor behaviour, and documenting findings in a clear, standardised format.
• Safeguarding evidence integrity and chain of custody in investigations with legal or regulatory implications.
• Creating, tuning and validating detection rules, queries and use cases to improve coverage and reduce false positives.
• Assessing detection gaps found during incidents and recommending improvements to logging, telemetry and controls.
• Developing, maintaining and exercising incident response plans, playbooks and call-out arrangements.
• Conducting post-incident reviews and root-cause analysis, and tracking corrective actions through to closure.

Required experience and skills:

• Experience in cyber incident response, security monitoring or a Security Operations Centre environment.
• Hands-on experience investigating alerts and incidents using SIEM and EDR/XDR technologies.
• Experience analysing Windows and Linux host artefacts, authentication activity, security logs, network traffic and packet captures.
• Working knowledge of the full incident response life cycle, from preparation through to lessons learned.
• Experience producing incident records, investigation reports, management updates and post-incident findings.
• Good understanding of cybersecurity frameworks and guidelines, including MITRE ATT&CK, the Cyber Kill Chain and NIST incident response guidance.
• Knowledge of core security domains, including enterprise networking, IAM, email and endpoint security, vulnerability management and data loss prevention.