Description
LSEG Security Operations is a central function that leverages people, processes, and technology to continuously monitor, detect, investigate, and respond to cyber security threats and incidents.
As a senior member of the Attack Monitoring team, you will provide technical leadership for investigations, support analyst development, and identify opportunities to enhance detection and response capabilities.
Responsibilities
- Act as the primary technical escalation point for cyber security alerts managed by the Attack Monitoring team.
- Lead complex investigations and provide hands-on technical analysis across a broad range of cyber security events and alerts.
- Serve as a senior technical leader and subject matter expert for Attack Monitoring analysts.
- Coach, mentor, and develop analysts, helping to strengthen the team's investigative capabilities and technical expertise.
- Assess incidents and investigations to determine when escalation to Incident Response is required, working closely with Incident Response teams to ensure effective handover and collaboration.
- Review alert volumes, trends, and investigation outcomes to identify opportunities to improve detection fidelity, reduce false positives, and enhance operational effectiveness.
- Partner with stakeholders across Security Operations to recommend and drive improvements to detection, monitoring, triage, and response processes.
- Identify opportunities to improve analyst workflows through automation and process optimisation, supporting implementation teams where appropriate.
- Develop and maintain investigation playbooks, alert guides, and knowledge articles informed by incident learnings, threat intelligence, and emerging attack techniques.
- Contribute to the continual improvement of Security Operations capabilities, processes, and procedures through innovation and technical expertise.
Experience
- Significant experience within a Security Operations Centre (SOC), Threat Detection and Monitoring, Incident Response, Digital Forensics, or a related cyber security function.
- Proven experience conducting end-to-end investigations across a wide range of cyber security alerts.
- Demonstrated experience coaching, mentoring, and developing technical teams.
- Track record of identifying and implementing operational improvements through innovation, automation, and subject matter expertise.
- Deep understanding of modern cyber adversary tactics, techniques, and procedures (TTPs).
- Advanced knowledge of operating systems including Windows, Linux, Unix, and macOS, as well as their associated artefacts and file systems.
- Experience investigating activity across enterprise environments, including endpoint, network, identity, and cloud-based technologies.
- Knowledge of public cloud platforms and services, including AWS, Azure, GCP, and Microsoft 365.
- Experience performing log analysis across multiple technology domains, including operating systems, network infrastructure, cloud platforms, and security tooling.
- Strong knowledge of Security Operations Centre practices, processes, and operating models.
- Strong understanding of incident response methodologies and frameworks, including NIST, SANS, or equivalent.
- Excellent written and verbal communication skills, with the ability to communicate technical concepts to both technical and non-technical audiences.
Benefits
- Healthcare
- Retirement planning
- Paid volunteering days
- Wellbeing initiatives