> Markdown version of [/jobs/ext/3031934-security-incident-response-analyst](https://www.wearedevelopers.com/jobs/ext/3031934-security-incident-response-analyst). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Security Incident Response Analyst - **Company:** KPMG International Cooperative - **Location:** Birmingham, UK - **Experience:** Expert - **Contract:** Permanent contract - **Skills:** Amazon Web Services, Microsoft Azure, Cloud Computing, Cloud Computing Security, Cyber Security, Digital Forensics, Intrusion Detection and Prevention, Automation of Marketing, Google Cloud, Computer Network Technologies, Azure Security Center, Microsoft Fabric, Cybercrime, Microsoft Sentinel, Security Orchestration, Automation & Response - **Published:** September 23, 2026 - **Apply:** https://performancemanager5.successfactors.eu/career?career_ns=job_application&company=KPMGHUKPROD&career_job_req_id=109490&selected_lang=en_GB ## About the Role * Demonstrable experience in security operations, incident response, cyber defence or digital forensics, including ownership of escalated security incidents. * Evidence of investigating threats across endpoint, identity, cloud, email and network environments and translating findings into appropriate response actions. * Practical knowledge of attacker tactics, techniques and procedures, with experience applying this knowledge to investigations or threat hunting. * Experience leading technical investigations, building incident timelines and completing root cause analysis and post-incident reporting. * Strong analytical and problem-solving skills, with evidence of making sound decisions and coordinating activity during high-pressure incidents. * Clear written and verbal communication skills, with experience explaining technical findings to technical and non-technical stakeholders and collaborating across security teams. Experience with Microsoft Sentinel, Microsoft Defender XDR, Microsoft Defender for Endpoint, Microsoft Defender for Identity, Microsoft Defender for Cloud, Microsoft Purview, digital forensics and incident response tools, security orchestration and automation platforms, threat hunting methods, or cloud security technologies across Microsoft Azure, Amazon Web Services or Google Cloud Platform would be beneficial. Relevant certifications, such as Microsoft Certified: Security Operations Analyst Associate (SC-200), CompTIA Cybersecurity Analyst (CySA+), GIAC Certified Incident Handler (GCIH), GIAC Certified Forensic Analyst (GCFA), Microsoft Certified: Azure Security Engineer Associate (AZ-500), or an equivalent qualification, would also be advantageous. ## Description This role sits within Group Corporate Services, which supports KPMG's people and business through firmwide specialist services and operational capabilities. Within Security Operations, you will join the Tier 2 Incident Response team and take ownership of complex investigations across a diverse technology environment serving KPMG in the UK and Switzerland. You will act as a senior escalation point for high-priority and major cyber security incidents, combining hands-on technical investigation with calm coordination and clear communication. The role is based in the UK on a hybrid basis and is at Grade D. Participation in the Security Operations on-call rota is required, including providing technical and operational leadership outside standard business hours. You must be eligible for Security Check clearance or able to obtain it. Roles and responsibilities * Lead investigations into complex and high-severity cyber security incidents, establishing the scope, business impact and risk. * Coordinate containment, eradication and recovery activities so incidents progress efficiently to a controlled resolution. * Provide senior technical guidance to analysts and act as an escalation point during high-priority and major incidents, including through the on-call rota. * Conduct forensic investigation and evidence collection across endpoint, identity, cloud, email and network technologies. * Produce clear investigation timelines, root cause analysis and post-incident reports for technical and business stakeholders. * Work with Threat Intelligence and Detection Engineering teams to apply knowledge of emerging threats, improve detection coverage and strengthen investigations. * Lead proactive threat hunting to identify previously undetected activity, security weaknesses and opportunities to improve controls. * Improve incident response playbooks, processes, automation and operational standards, sharing knowledge across the wider cyber security function. ## Related Videos - [The Cloud is Calling: Answer with In-Demand Skills](https://www.wearedevelopers.com/videos/945-the-cloud-is-calling-answer-with-in-demand-skills) - [Fighting the Next Wave of Cybercrime](https://www.wearedevelopers.com/videos/100331-fighting-the-next-wave-of-cybercrime) - [Checkmate: 5 Real Incidents That Can End a Software Company](https://www.wearedevelopers.com/videos/100126-checkmate-5-real-incidents-that-can-end-a-software-company) - [Thinking Differently - How to Make Money from Cyber Attacks & Cheats](https://www.wearedevelopers.com/videos/745-thinking-differently-how-to-make-money-from-cyber-attacks-cheats) - [What makes Cybersecurity different for critical infrastructure?](https://www.wearedevelopers.com/videos/571-what-makes-cybersecurity-different-for-critical-infrastructure) - [Cyber Security: Small, and Large!](https://www.wearedevelopers.com/videos/259-cyber-security-small-and-large) ## Related Articles - [What Are The Top Skills Required For Azure Developers?](https://www.wearedevelopers.com/magazine/77-what-are-the-top-skills-required-for-azure-developers) - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Data Analyst Salary in the UK](https://www.wearedevelopers.com/magazine/278-data-analyst-salary-in-the-uk) - [The Geometry of Incidents: Connecting User Impact to Architecture](https://www.wearedevelopers.com/magazine/764-the-geometry-of-incidents-connecting-user-impact-to-architecture) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks)