CSIRT Analyst (Cyber Security Incident Response Team)

This role focuses on coordinating and supporting the response to cybersecurity incidents, ensuring any potential threats are contained, managed, and resolved effectively. The position plays a key part in minimising business impact, guiding recovery efforts, and helping prevent future incidents through continuous improvement.

Responsibilities:

• Coordinate and manage the response to cybersecurity incidents, helping to minimise business impact and support recovery activities.
• Monitor, analyse and investigate security alerts, incidents and suspicious activity using logs, security tools and operational data.
• Conduct detailed threat and security incident investigations, identifying root causes and recommending corrective actions.
• Prioritise, escalate and resolve security incidents in line with established processes and procedures.
• Support the ongoing improvement of security monitoring, dashboards, reporting and threat detection capabilities.
• Assist with vulnerability assessments, security risk analysis and business impact assessments to strengthen organisational resilience.
• Provide guidance to colleagues and stakeholders on security best practices, policies and technical controls.
• Support the operation and optimisation of security technologies, including SIEM, IDS/IPS, firewalls, anti-virus and vulnerability management tools.
• Perform digital forensic activities, including evidence collection, forensic analysis and documenting findings to support investigations.
• Contribute to the development and maintenance of security policies, standards, playbooks and continuous improvement initiatives.

Requirements:

• Experience working within a Security Operations Centre (SOC) or Cyber Security Incident Response Team (CSIRT) environment, investigating and responding to complex security incidents.
• Knowledge of malware analysis and the ability to investigate and assess malicious threats.
• Relevant industry-recognised cybersecurity certifications, such as CISSP, SSCP, GIAC, GSEC or CEH.
• Proven experience delivering technical solutions and security outcomes within fast-paced, enterprise environments.
• Strong expertise in at least one infrastructure domain, such as End User Computing, Hosting, or Networks.
• Experience using security monitoring and incident detection tools to identify and respond to threats.
• Knowledge of cloud security and experience managing security incidents within cloud environments.
• Understanding of vulnerability management, threat intelligence and proactive threat mitigation.
• Familiarity with network, perimeter and host-based intrusion techniques, attack methods and security controls.
• Strong communication and stakeholder management skills, with the confidence to act as a trusted technical authority and provide pragmatic, risk-based security guidance.

Benefits:

• 25 days holiday, increasing through length of service, with option to buy or sell
• Bupa health insurance as a benefit in kind
• An enhanced pension plan and life insurance
• Onsite gyms or local discounts where no onsite gym available
• Various other benefits and online discounts