Incident Response Analyst
We are seeking an experienced Incident Response Analyst to support the detection, triage, investigation, containment and resolution of cyber security incidents across a complex enterprise environment.
Key Responsibilities
Monitor and investigate alerts from SIEM, EDR/XDR, identity, email, cloud and network security technologies.
Triage incidents, assess severity and business impact, and coordinate containment, eradication and recovery.
Investigate phishing, malware, account compromise, data loss, unauthorised access and suspicious network activity.
Collect, preserve and analyse endpoint, server, identity, network, email and cloud artefacts.
Analyse logs, packet captures, forensic images and security telemetry to establish scope, root cause and attacker activity.
Identify IOCs, attacker behaviours, TTPs and map findings to MITRE ATT&CK where appropriate.
Develop and execute threat hunts and contribute to detection rule, monitoring and logging improvements.
Maintain incident records, investigation timelines, evidence and post-incident reports.
Develop and maintain incident response playbooks, procedures and communication processes.
Conduct post-incident reviews, root-cause analysis and lessons-learned activities.
Provide clear technical and management updates to senior stakeholders.
Essential Skills & Experience
Practical experience in cyber security incident response, security monitoring or a SOC environment.
Hands-on experience with SIEM and EDR/XDR technologies.
Experience investigating Windows and Linux systems, authentication activity, security logs and network traffic.
Strong understanding of the incident response lifecycle.
Knowledge of MITRE ATT&CK, Cyber Kill Chain and NIST.
Good understanding of enterprise networking, IAM, cloud, email and endpoint security.
Experience with digital forensics and evidence handling.
Strong communication, investigation and analytical skills.
Desirable
Banking, financial services or other regulated-sector experience.
Microsoft Sentinel, Defender XDR, Defender for Identity or Defender for Cloud.
KQL, PowerShell, Python or similar scripting/automation.
Threat hunting, malware analysis and detection engineering.
Azure and Microsoft 365 investigation experience.
EnCase, FTK, Velociraptor, Volatility or Wireshark.
Certifications such as GCIH, GCIA, GCFA, GNFA, SC-200, CySA+ or CISSP.
Qualifications
Relevant cyber security experience, degree or equivalent practical experience. Knowledge of NIST, CIS Controls and recognised information security standards