Senior Security Operations Analyst

You’ll protect key business assets by monitoring, detecting, analysing and responding to security incidents, owning threat detection and incident response at real scale., * SIEM ownership: Oversee the day-to-day running of the SIEM, working closely with Infrastructure, Networks, DevOps and an outsourced SOC.

• Detection rules: Define and fine-tune SIEM rules, and investigate alerts and incidents through to completion.
• Incident response: Gather and analyse data, then contain and respond to cyber security incidents as part of a dynamic monitoring and response capability.
• Threat intelligence and hunting: Gather threat intelligence from multiple sources, coordinate threat hunting, spot trends and attacks, and plan mitigation and remediation.
• Escalation and remediation: Raise problems, escalate through the right channels and track them through to resolution.
• EDR: Manage Endpoint Detection and Response day to day.
• Policy and control design: Help design, manage and document security policies, standards and processes, and design effective test methods for logical security controls.
• Staying current: Keep up with the latest threats, best practice and technology developments.

• Hands-on SIEM experience with Chronicle / Google SecOps, Splunk or Microsoft Sentinel, and a good working knowledge of event log data.
• Solid understanding of firewalls, IDS/IPS and Windows Security Event Logs.
• Knowledge of cloud infrastructure fundamentals alongside traditional technologies.
• Ability to quickly understand existing infrastructure, network security principles, data flows and security architectures.
• A proactive approach to identifying control weaknesses and vulnerabilities.
• Strong written and verbal communication, able to explain complex technical risk in plain business terms.
• A sense of ownership, with the confidence to spot what needs doing while working well in a team.