# Senior Technical Lead - Attack Monitoring **Company**: London Stock Exchange Group (LSEG) **Location**: London **Experience**: senior **Job type**: full-time **Category**: Security **Industry**: Finance **Apply**: https://lseg.wd3.myworkdayjobs.com/en-US/Careers/job/Singapore---Raffles-Quay/Principal-Attack-Monitoring-Analyst--GSOC-_R0124005?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply **Canonical**: https://yubhub.co/jobs/job_0a11a0ae-65b ## Description LSEG Security Operations is a central function that leverages people, processes, and technology to continuously monitor, detect, investigate, and respond to cyber security threats and incidents. As a senior member of the Attack Monitoring team, you will provide technical leadership for investigations, support analyst development, and identify opportunities to enhance detection and response capabilities. **Responsibilities** - Act as the primary technical escalation point for cyber security alerts managed by the Attack Monitoring team. - Lead complex investigations and provide hands-on technical analysis across a broad range of cyber security events and alerts. - Serve as a senior technical leader and subject matter expert for Attack Monitoring analysts. - Coach, mentor, and develop analysts, helping to strengthen the team's investigative capabilities and technical expertise. - Assess incidents and investigations to determine when escalation to Incident Response is required, working closely with Incident Response teams to ensure effective handover and collaboration. - Review alert volumes, trends, and investigation outcomes to identify opportunities to improve detection fidelity, reduce false positives, and enhance operational effectiveness. - Partner with stakeholders across Security Operations to recommend and drive improvements to detection, monitoring, triage, and response processes. - Identify opportunities to improve analyst workflows through automation and process optimisation, supporting implementation teams where appropriate. - Develop and maintain investigation playbooks, alert guides, and knowledge articles informed by incident learnings, threat intelligence, and emerging attack techniques. - Contribute to the continual improvement of Security Operations capabilities, processes, and procedures through innovation and technical expertise. **Experience** - Significant experience within a Security Operations Centre (SOC), Threat Detection and Monitoring, Incident Response, Digital Forensics, or a related cyber security function. - Proven experience conducting end-to-end investigations across a wide range of cyber security alerts. - Demonstrated experience coaching, mentoring, and developing technical teams. - Track record of identifying and implementing operational improvements through innovation, automation, and subject matter expertise. - Deep understanding of modern cyber adversary tactics, techniques, and procedures (TTPs). - Advanced knowledge of operating systems including Windows, Linux, Unix, and macOS, as well as their associated artefacts and file systems. - Experience investigating activity across enterprise environments, including endpoint, network, identity, and cloud-based technologies. - Knowledge of public cloud platforms and services, including AWS, Azure, GCP, and Microsoft 365. - Experience performing log analysis across multiple technology domains, including operating systems, network infrastructure, cloud platforms, and security tooling. - Strong knowledge of Security Operations Centre practices, processes, and operating models. - Strong understanding of incident response methodologies and frameworks, including NIST, SANS, or equivalent. - Excellent written and verbal communication skills, with the ability to communicate technical concepts to both technical and non-technical audiences. **Benefits** - Healthcare - Retirement planning - Paid volunteering days - Wellbeing initiatives ## Skills ### Required - Security Operations Centre - Threat Detection and Monitoring - Incident Response - Digital Forensics - Cyber Security - Windows - Linux - Unix - macOS - AWS - Azure - GCP - Microsoft 365 - NIST - SANS ### Nice to have - Global financial services - Highly regulated environments - GIAC - CREST - GCFA - GCIH - GNFA - Scripting or programming languages - Security automation and orchestration technologies --- Source: [Apply at lseg.wd3.myworkdayjobs.com](https://lseg.wd3.myworkdayjobs.com/en-US/Careers/job/Singapore---Raffles-Quay/Principal-Attack-Monitoring-Analyst--GSOC-_R0124005?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply)