> Markdown version of [/jobs/ext/2793249-senior-it-security-analyst](https://www.wearedevelopers.com/jobs/ext/2793249-senior-it-security-analyst). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Senior IT Security Analyst - **Company:** EDF Energy - **Location:** Greater London, UK - **Experience:** Expert - **Contract:** Permanent contract - **Skills:** Microsoft Windows, Access Network, Active Directory, Artificial Intelligence, Data Analysis, Microsoft Azure, Software as a Service, Cloud Computing, Cloud Computing Security, Cyber Security, Identity and Access Management, Network Security, Microsoft Security Essentials, Windows PowerShell, Remote Access Technology, Phishing, Zero Trust Network Access, Web Application Security, Single Sign-On, Traffic Analysis, Software Vulnerability Management, Scripting, Mitre Att&ck, Tactics, Techniques and Procedures (TTPs), Cybercrime, Microsoft Sentinel, Security Orchestration, Automation & Response, Vulnerability Analysis - **Published:** September 8, 2026 - **Apply:** https://www.collegerecruiter.com/job/2840628889-senior-it-security-analyst ## About the Role * Strong security mindset, with curiosity about how attacks work and how controls fail. * Outcome-focused and accountable, with strong attention to accuracy and detail. * Proactive, tenacious and comfortable solving ambiguous technical problems. * Able to work independently while knowing when to elevate material risk or uncertainty. * Comfortable balancing tactical operational demands with longer-term control improvement. * Confident communicator who can explain technical issues clearly to different audiences. * Collaborative and credible with infrastructure, cloud, application, identity and business stakeholders. * Willing to mentor others and raise the technical capability of the team. * Comfortable operating in a fast-paced trading environment with competing priorities. Hours of work: Core hours of 8.30am - 5.30pm; however, flexibility is required to meet essential business deadlines. Hybrid working arrangement with a minimum of three days per week in the office. ## Description To act as a senior technical contributor within EDF Trading's global cyber security team, owning selected cyber security domains end-to-end and driving practical improvements to reduce cyber risk. The role combines analyst and engineering responsibilities across security tools, vulnerability and exposure management, web and email security, incident response, and threat-informed remediation. The role works closely with infrastructure, cloud, application, identity and business teams to identify security issues, prioritise actions based on real-world attacker behaviour, and deliver measurable improvements to EDF Trading's cyber defence posture. To support EDF Trading's cloud security by advising on, reviewing and improving Microsoft Azure and 365 security controls., Cybersecurity Domain Ownership & Improvement (30%) * Own one or more cyber security domains end-to-end, ensuring risks, controls, tooling, remediation activity and improvement backlogs are understood and actively managed. * Identify weaknesses, exposures and control gaps across assigned domains and drive resolution with the relevant technical owners. * Lead security improvement initiatives from analysis and design to implementation, documentation and operational handover. * Translate threat intelligence, MITRE ATT&CK techniques and observed attacker behaviours into practical control improvements. * Maintain clear domain-level documentation, including risks, controls, technical standards, operational processes and improvement plans. * Provide senior technical input into security roadmaps and control improvement activities. Security Tooling Administration & Engineering (25%) * Administer, configure and continuously improve cyber security tools, including CrowdStrike, Zscaler ZIA/ZPA, and BeyondTrust Endpoint Privilege Management (EPM). * Improve security tooling effectiveness by tuning configurations, reducing noise, improving visibility and increasing operational value. * Design, build and deploy small tools, scripts, dashboards or automations to improve operations. * Support integration of tooling into workflows, reporting and incident response processes. * Maintain practical knowledge of Microsoft 365, Azure / Entra ID and Microsoft security controls, supporting improvements with the primary platform owners. * Use automation and AI-enabled workflows responsibly to accelerate analysis, documentation, query development and repetitive operational tasks., * Support vulnerability management by analysing weaknesses, validating risk, prioritising remediation and tracking material issues to closure. * Apply threat intelligence, exploitation evidence, asset criticality and business context to prioritise remediation activity. * Identify and manage exposure risks across endpoints, identity, SaaS, remote access and cloud-adjacent environments. * Support attack path reduction activity across Active Directory, Entra ID and privileged access pathways. * Use tools such as PingCastle and BloodHound Enterprise to identify identity-related weaknesses and drive remediation with infrastructure and identity teams. * Advise technical teams on secure configuration and hardening improvements, including Active Directory, GPO, Microsoft 365, Azure Policy and identity controls. Security Investigations & Incident Response (15%) * Lead or support investigations into alerts, suspicious activity, phishing, endpoint events, identity anomalies and other cyber security incidents. * Coordinate with the MDR provider, IT teams and system owners to validate detections, contain threats and complete remediation actions. * Contribute to incident response playbooks, detection improvements, tabletop exercises and operational readiness activities. Stakeholder Engagement, Mentoring & Governance Support (10%) * Represent cyber security in technical discussions, project forums and governance meetings. * Work closely with infrastructure, cloud, application, identity, service desk, compliance and business stakeholders to resolve security risks. * Communicate risks, remediation options and recommended actions clearly to technical and non-technical stakeholders., * Owned or materially contributed to one or more cyber security domains, such as endpoint security, vulnerability management, identity security, network security, incident response or Microsoft 365 / Azure security. * Used CrowdStrike or equivalent EDR tooling to investigate detections, support incident response and improve endpoint security controls. * Used Zscaler ZIA/ZPA or equivalent secure web gateway, private access, zero trust or network access security technologies. * Performed vulnerability assessment, exposure analysis or remediation prioritisation across enterprise technology environments. * Applied threat intelligence, MITRE ATT&CK or exploitation-based evidence to prioritise mitigations. * Supported or led cyber security investigations and incident response activities. * Collaborated with infrastructure, cloud, application, identity and business teams to deliver security improvements. * Used scripting, queries, automation or data analysis to improve security outcomes., * Strong hands-on experience administering, tuning and operationalising CrowdStrike Falcon, including endpoint protection, EDR investigations, detection analysis and response workflows. * Strong hands-on experience administering and supporting Zscaler ZIA and ZPA, including policy design, access control, traffic analysis and security troubleshooting. * Practical experience leading or supporting vulnerability and exposure management programmes, including vulnerability analysis, risk-based prioritisation, remediation tracking and validation of control effectiveness. * Strong knowledge of real-world attacker tactics, techniques and procedures (TTPs) and the ability to translate threat intelligence, attack paths and exploitation trends into actionable security improvements. * Experience conducting security investigations and incident response activities, including alert triage, root cause analysis, containment, remediation and lessons learned. Desirable - some of the following (we don't expect any one candidate to have them all) * Identity Security + Active Directory and Group Policy security and hardening + Entra ID security + Conditional Access + MFA design and implementation + Identity governance + Single Sign-On * Attack Path Management + PingCastle + BloodHound Enterprise + Attack path analysis and reduction * Microsoft Security Technologies + Microsoft Defender + Microsoft Sentinel + Microsoft Defender for Cloud Apps + Microsoft 365 security controls + Azure Policy * Detection, Hunting & Automation + Threat hunting + Custom detections and security queries + PowerShell or Python scripting + Security automation and SOAR ## Related Videos - [What makes Cybersecurity different for critical infrastructure?](https://www.wearedevelopers.com/videos/571-what-makes-cybersecurity-different-for-critical-infrastructure) - [Fighting the Next Wave of Cybercrime](https://www.wearedevelopers.com/videos/100331-fighting-the-next-wave-of-cybercrime) - [JavaScript? No. Java Scripts! - Scripting with Java](https://www.wearedevelopers.com/videos/2094-javascript-no-java-scripts-scripting-with-java) - [Passkeys: Truly Phishing-Resistant? Implementation and Pitfalls](https://www.wearedevelopers.com/videos/100156-passkeys-truly-phishing-resistant-implementation-and-pitfalls) - [Checkmate: 5 Real Incidents That Can End a Software Company](https://www.wearedevelopers.com/videos/100126-checkmate-5-real-incidents-that-can-end-a-software-company) - [Deep Fakes: The Lies We Can’t See](https://www.wearedevelopers.com/videos/1187-deep-fakes-the-lies-we-can-t-see) ## Related Articles - [Data Analyst Salary in the UK](https://www.wearedevelopers.com/magazine/278-data-analyst-salary-in-the-uk) - [IT Salaries in UK](https://www.wearedevelopers.com/magazine/288-it-salaries-in-uk) - [A Guide to Green Tech and Green IT Careers](https://www.wearedevelopers.com/magazine/374-a-guide-to-green-tech-and-green-it-careers) - [The Most Popular IT Jobs on the Market](https://www.wearedevelopers.com/magazine/376-the-most-popular-it-jobs-on-the-market) - [UK Business Culture and Etiquette](https://www.wearedevelopers.com/magazine/326-uk-business-culture-and-etiquette) - [Data Engineer Salary UK](https://www.wearedevelopers.com/magazine/253-data-engineer-salary-uk)