Cyber Security Analyst

The successful candidate will support our clients Cyber and Information Security function. Their mission is to secure digital and information assets against misuse and enable the secure delivery of the department s mission. They do this by developing, operating and governing the cyber and information security controls which protect our nationwide internal IT infrastructure, and high-profile citizen-facing digital services. This role is within the Cyber Defence team, which is responsible for understanding, detecting and responding to cyber threats and vulnerabilities impacting our client. This role is responsible for supporting their alert triage and incident response capability., * Triage and investigate cyber security alerts and reports from users.

• Use a variety of techniques to analyse systems, files, network traffic and cloud environments and understand the nature and extent of possible cyber incidents.
• Support the technical response to cyber incidents by identifying and implementing (or supporting the implementation of) containment, eradication and recovery actions.
• Support the coordination of cyber incidents.
• Contribute to post-incident reviews to identify lessons and actions.
• Identify opportunities for, and support the delivery of, continual improvements to the incident investigation and response capability.
• Work closely alongside other Cyber Defence functions, supporting the continual improvement of wider capabilities.
• Contribute to internal plans, playbooks and knowledge base articles.
• Act as an escalation point for, and provide coaching and mentoring to, apprentice security analysts.
• Be responsible for line management of apprentice security analysts.
• Cyber incidents can and do arise on a 24/7 basis. The team operates an out-of-hours on call rota, which you will be expected to join.

• Experience investigating and responding to cyber incidents.
• Experience using security tools (e.g., EDR, SIEM) to support the investigation and response to cyber incidents.
• Experience with SIEM tools (experience of Splunk preferred but experience of Microsoft Sentinel or an equivalent SIEM tool is acceptable).
• An understanding of the tools, techniques and procedures commonly used by threat actors.
• Good analytical and problem-solving skills.
• Good verbal and written communication skills.
• Active SC clearance.
• At least 2-3 years experience in a position of Cyber Security Analyst.
• Working experience of M365 (Microsoft Defender / Sentinel / KQL).

Desirable:

• Experience with Splunk.
• Experience working in an Agile environment.
• Experience with cloud environments such as AWS.