> Markdown version of [/jobs/ext/4612821-cyber-defence-analyst](https://www.wearedevelopers.com/jobs/ext/4612821-cyber-defence-analyst). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Cyber Defence Analyst - **Company:** Leidos, Inc. - **Location:** Farnborough, UK (Remote available) - **Salary:** £36,900.0 - £46,100.0 - **Contract:** Permanent contract - **Skills:** Amazon Web Services, Microsoft Azure, Cyber Security, Computer Telephony Integration, Domain Name System (DNS), Hypertext Transfer Protocols (HTTP), Security Information and Event Management, TCP/IP, Software Vulnerability Management, Computer Network Technologies, Mitre Att&ck, Cyber Threat Analysis, Cybercrime, Microsoft Sentinel - **Published:** November 7, 2026 - **Apply:** https://dejobs.org/x/x/603844B6D39D472593390AA3C048D674/job/ ## About the Role * Experience investigating security events and incidents in a CSOC or comparable environment, or demonstrable transferable skills and the ability to develop rapidly. * Working knowledge of Microsoft Sentinel, Microsoft Defender XDR, Microsoft Defender Vulnerability Management, Microsoft Azure and Amazon Web Services (AWS). * Experience of proactive threat hunting and of using validated investigation outcomes to improve detection and response. * Understanding of the Confidentiality, Integrity and Availability (CIA) triad and its practical application when assessing technical and business impact. * Current awareness of malware, ransomware and advanced persistent threat activity affecting cloud and on-premises environments. * Practical knowledge of MITRE ATT&CK and its use in describing tactics, techniques, sub-techniques and observed adversary behaviour. * Experience working within change-controlled environments and following authorised operational procedures. * Exposure to HMG-classified systems or programmes is advantageous but not essential. * Understanding of core networking concepts, including TCP/IP, DNS, HTTP/S, common ports and protocols, and how network and cloud security controls generate investigative evidence. * Ability to interpret common endpoint, identity, cloud, network and application log sources and recognise where evidence gaps may limit investigative confidence. Communication and Professional Skills * Communicates technical findings, risk and recommended actions clearly to technical and non-technical audiences through handovers, incident records, reports and stakeholder briefings. * Demonstrates calm judgement and professional credibility when presenting evidence, challenging assumptions and making proportionate recommendations under pressure. * Builds trusted relationships with customers and internal stakeholders while maintaining appropriate confidentiality, account separation and professional boundaries. * Approaches problems logically, tests assumptions and develops practical, prioritised remediation plans. * Manages competing priorities, recognises material risk and escalates decisively through the appropriate route when required. * Works effectively within a shift team and with minimal supervision, welcomes constructive feedback and respects differing viewpoints. * Takes ownership, works through obstacles and drives agreed actions to completion, maintaining clear accountability throughout. * Maintains relevant professional knowledge of cyber security threats, technologies and industry developments and applies it appropriately to the role. * Demonstrates the reliability and flexibility needed to support the agreed shift rota and maintain continuous protection of customers. Department: CSOC - 24x7x365 multi-customer service Security Requirement: Candidates must be eligible and willing to obtain the level of SC and/or DV security clearance required for the programmes they support, and must meet applicable customer nationality requirements. Security clearance is not required on entry unless specified for a particular programme. ## Description The Cyber Defence Analyst protects customer services by identifying, investigating and helping to contain cyber threats across a 24x7x365 multi-customer CSOC. The role converts security telemetry, threat intelligence and vulnerability information into timely, evidence-led decisions. Success is demonstrated through accurate alert disposition, complete incident records, decisive escalation, effective handovers and practical improvements to detection and response. Typically knowledge of CSOC or security operations experience, or credible transferable cyber security knowledge, qualifications and practical aptitude, supported by the motivation to develop quickly in the role. Your Key Outcomes and Responsibilities * Monitor security alerts continuously and take timely, consistent action in line with agreed service priorities, protecting customer services and reducing the time threats remain undetected or uncontained. * Analyse alerts and supporting telemetry from SIEM, EDR and XDR platforms to establish the context, scope, severity and potential business impact of suspicious activity. * Distinguish true positives from benign or false-positive activity, document an evidence-based rationale and escalate material risk without delay. * Create and maintain complete, accurate cyber security incident records in the relevant IT service management (ITSM) tool, ensuring that evidence, timestamps, affected assets, indicators, actions, ownership and escalation decisions support effective response, handover and audit. * Correlate logs and events across multiple sources to identify suspicious patterns, likely attack paths and Indicators of Compromise (IOCs), improving investigative confidence and speed. * Map observed adversary behaviour to relevant MITRE ATT&CK tactics, techniques and sub-techniques, supporting consistent analysis, clearer communication and visibility of detection coverage. * Create, test and tune threat-hunting queries and, where appropriate, convert validated findings into detection rules that improve coverage, signal quality and analyst efficiency. * Apply Cyber Threat Intelligence (CTI) to investigations and hunting, translating relevant indicators, adversary behaviours and affected technologies into practical detection, prioritisation and response actions. * Assess vulnerabilities in context, explaining likely impact, exposure, exploitability and available evidence of exploitation so that stakeholders can prioritise proportionate remediation. * Recommend proportionate countermeasures and coordinate agreed containment, eradication and recovery actions to reduce risk and restore secure operations. * Proactively identify suspicious activity, exploitable vulnerabilities and security misconfigurations, enabling action before they result in material customer impact. * Apply incident response processes, playbooks and prioritisation criteria consistently; contribute evidence to root-cause analysis and lessons learned so that repeat risk is reduced. * Produce concise, accurate incident records, reports and shift handovers that make decisions, actions, residual risks, ownership and next steps unambiguous. * Safeguard customer information and maintain strict separation, confidentiality and professional discretion when working across multiple accounts. * Collaborate with technical teams, customers and other stakeholders to drive investigations and agreed response actions to a controlled, documented conclusion. * Contribute to tabletop exercises, post-incident reviews and measurable service improvements that strengthen detection, response and operational resilience.