Security Operations Analyst

We are looking for a Security Operations Analyst to join our team at Zopa. As a Security Operations Analyst, you will play an important role in protecting our banking services, systems, and customers.

Our Security Operations team is a collaborative team with a mix of technical experience and professional backgrounds, working together to investigate security threats, respond to incidents, and continuously improve how we operate.

Responsibilities:

• Review, triage, and investigate security alerts, events, and incident tickets.
• Analyse security logs to identify suspicious activity, assess potential impact, and determine appropriate next steps.
• Investigate common threats including phishing, malware, and account compromise.
• Follow established incident response playbooks, escalating incidents and requesting support when needed.
• Maintain accurate investigation notes, ticket updates, and incident documentation.
• Work within defined response and resolution expectations for security tickets.
• Collaborate with IT Services, Identity and Access Management, engineering, fraud, and customer service teams.
• Develop practical experience with security technologies including Splunk, SentinelOne, Netskope, and AWS security services.
• Participate in peer reviews and incident retrospectives, sharing lessons learned with colleagues.
• Support improvements to security processes and develop your understanding of vulnerability management, cloud security, and security tooling.

Requirements:

• Practical experience in security operations or a relevant technical environment such as infrastructure, network, cloud operations, or IT support.
• Understanding of cyber security fundamentals, including phishing, malware, account compromise, vulnerabilities, threats, and risks.
• Experience reviewing security alerts or analysing logs to investigate unusual activity.
• Knowledge of the incident response lifecycle and can follow documented procedures.
• Foundational knowledge of Windows, macOS, Linux, and core networking concepts.
• Understand basic cloud concepts, particularly AWS services such as IAM, S3, and CloudTrail.
• Analytical approach to investigations, gathering evidence and assessing potential impact before deciding what to do next.
• Strong communication skills, able to communicate clearly, document findings accurately, and know when to escalate.
• Ability to prioritise security tickets, manage time, and work within agreed service levels.
• Curious, eager to learn, comfortable asking for support, and committed to working collaboratively.

Nice to Have:

• Experience using SIEM, EDR, or security tools such as Splunk, SentinelOne, Netskope, Mimecast, Tenable, or AWS GuardDuty.
• Basic scripting experience using Python, Bash, or PowerShell.
• Practical experience with phishing investigations or vulnerability management.
• Familiarity with the MITRE ATT&CK framework.
• Experience using Git or version control alongside engineering teams.
• Experience working in financial services, fintech, or another regulated environment.
• Awareness of FCA requirements and UK GDPR.
• Security certifications such as CompTIA Security+, CySA+, or CEH, or a relevant degree.
• Experience safely using AI tools to support everyday work.