Incident Response Analyst

We’re looking for an experienced Cyber Security Incident Response Analyst to join a high-performing cyber security team, helping defend a large enterprise against evolving cyber threats. This is an excellent opportunity to work on complex security incidents, investigate emerging threats and strengthen an organisation’s overall cyber resilience.

Working within a collaborative security function, you’ll play a key role in identifying, analysing and responding to security incidents, partnering with infrastructure, cloud, identity and business teams to minimise risk and improve security capabilities.

The Role

• Investigate and respond to cyber security incidents across enterprise environments.
• Monitor and triage alerts from SIEM, EDR/XDR, cloud, identity, endpoint and network security tools.
• Analyse malicious activity including phishing, ransomware, account compromise, insider threats and unauthorised access.
• Coordinate incident containment, remediation and recovery with technical teams and key stakeholders.
• Carry out digital forensic investigations, preserving and analysing evidence from endpoints, servers, cloud platforms and network activity.
• Perform proactive threat hunting and identify attacker techniques, tactics and indicators of compromise.
• Enhance detection capabilities through alert tuning, threat intelligence and continuous improvement of monitoring rules and playbooks.
• Produce clear incident reports, technical findings and post-incident recommendations to improve future response.

You’ll ideally have:

• Experience working within a Security Operations Centre (SOC), Cyber Defence or Incident Response function.
• Strong hands-on experience with SIEM, EDR/XDR and enterprise security monitoring technologies.
• Knowledge of Windows, Linux, networking, cloud security and identity management.
• Experience investigating complex cyber incidents and communicating findings to both technical and non-technical stakeholders.
• A solid understanding of incident response methodologies, digital forensics and frameworks such as MITRE ATT&CK and NIST.
• Exposure to Microsoft security technologies, threat hunting, scripting (PowerShell, Python or KQL) or forensic tooling would be advantageous.