SOC Shift Analyst
Role details
Job location
Tech stack
Job description
The SOC Shift Analyst role is a vital part of the Security Operations team, reporting to the SOC Manager. This role will be responsible for the proactive security monitoring of the Allwyn estate and the detect and respond phases of cyber security incident response and will be instrumental in supporting and advancing the operational security capabilities of the SOC Team The Security Operations Analyst will have primary responsibility for all technologies managed directly by the SOC team but also need to track, check and report on security events discovered by our MSSP., * Continuously monitor security tools, dashboards, and systems for potential security incidents.
- Track security alerts and escalate issues according to the severity and impact.
- Investigate security incidents or alerts triggered by monitoring tools to determine whether they represent legitimate threats (e.g., malware, phishing, unauthorised access).
- Assist in the initial response to low-level security incidents, escalate more severe incidents to Lead SOC analysts or security engineers when necessary.
- Analyse and review logs from various systems and applications (e.g., network devices, servers, endpoints) to identify potential threats and suspicious activities.
- Correlate data from different sources to build a complete picture of ongoing security incidents.
- Perform initial triage to categorize incidents by severity (e.g., false positives, low-risk, high-risk incidents).
- Identify the type of attack (e.g., phishing, ransomware, DDoS) and begin documenting the event for further analysis.
- Identify opportunities for security improvements and work with relevant infrastructure teams to implement effectively.
- Assist in the develop of operational metrics and dashboard reporting for operational security posture., * Innovation - We pride ourselves on it! We're constantly looking for new ways to excite our customers, bringing new products to enjoy which is all underpinned by our responsible play values and making them accessible to all.
- Giving back - Did you know that playing the lottery generates around £30m a week for charities and good causes in the UK? Our aim is to have doubled this number by the end of the first 10 year licence
- Sustainability - Our aim to be net zero by 2030 which would make us the first lottery provider globally to achieve thi
- Inclusion and accessibility - We are making all parts of The National Lottery inclusive - whether you play a game in a store or online.
Requirements
Do you have experience in VPN?, * Ability to work independently to delivery against personal and team objectives, liaising with relevant teams.
- Good network knowledge and principles; LAN, TCP/IP, OSI Model, DNS, DHCP, Wi-Fi, Routing, VPN, Firewalls, Load Balancing, IPv4
- Understanding of key windows domain services, such as Active Directory and Windows Server environments.
- Hands on experience of common security controls, such as IDS, Web content filters, AV, SIEM, Vulnerability Management, and awareness of their purpose in a layered security approach
- Demonstrable experience of Azure security solutions
- Experience and understanding of the ITIL approach to service management.
- In depth knowledge of the Mitre Att&ck framework. Desirable:
- A qualification or certification in cyber security attack or defence e.g. (BTL1, GCIA, GCIH, GCFA, GREM)
- Experience with alerts generated in Azure Unified Logs / Exchangeonline / AWS Guardduty / AWS Cloudtrail / Salesforce Shield / Palo Prisma / Entra-ID / Azure PIM / Defender for Cloud / Defender for endpoint / Defender for servers / Azure Information Protection DLP / Insider Threat experience / Purvue and or Macie