2nd / 3rd Line Security Analyst

• Own the end-to-end security incident lifecycle including triage, investigation, remediation and closure
• Perform advanced investigations using SIEM, EDR and XDR platforms
• Conduct root cause analysis and feed insights back into detection improvements
• Design and tune SIEM detection rules to improve accuracy and reduce false positives
• Align detection and response activities with the MITRE ATT&CK framework
• Build and maintain automated security workflows using tools such as Logic Apps, Python and APIs
• Conduct proactive threat hunting using behavioural analytics and threat intelligence
• Monitor and respond to security events across cloud platforms including Azure, Microsoft 365 and AWS
• Investigate identity-based threats such as suspicious sign-ins and privilege escalation
• Support endpoint security technologies including EDR, antivirus and patching
• Act as an escalation point for complex or high-risk incidents
• Support compliance frameworks including ISO 27001 and Cyber Essentials
• Maintain accurate documentation, procedures and knowledge base articles
• Provide guidance and support to junior analysts and service desk colleagues

Essential:

• Strong experience within a Security Operations or SOC environment
• Hands-on experience with SIEM, EDR and SOAR platforms
• Proven experience in detection engineering and SIEM rule tuning
• Strong understanding of cyber threat frameworks such as MITRE ATT&CK
• Experience automating processes using Python, Logic Apps or APIs
• Experience investigating incidents across cloud, identity and endpoint environments
• Ability to communicate technical information clearly to a range of stakeholders
• Experience with platforms such as Microsoft Sentinel, Defender XDR, CrowdStrike or similar
• Knowledge of Azure and AWS security monitoring
• Experience in threat hunting and security analysis
• Understanding of ISO 27001 and Cyber Essentials

Desirable:

• CISSP or similar certification
• Experience improving or designing SOC operations or security platforms
• Exposure to security architecture or engineering
• Experience supporting automation and continuous improvement initiatives

• Improving detection accuracy and incident response effectiveness
• Strengthening the overall security posture
• Reducing manual effort through automation
• Maintaining high service quality and managing risk effectively
• Supporting strong customer satisfaction and trust