Description
The Analyst, Proactive Defense Operations will deliver the team's work and act as a senior hands-on contributor within Proactive Defense Operations (PDO). This is a hands-on analytical role within the team, focused on converting global threat data into validated, automated defensive action at machine speed.
About the team: Proactive Defense Operations (PDO) moves GSK from an intelligence-and-reporting model to an automation- and engineering-centric capability. The team converts global threat data into immediate, validated operational actions, interrogating internal telemetry, triggering automated defenses and equipping defenders with contextualized, high-fidelity blueprints.
Key responsibilities:
- Deliver assigned work to agreed quality and timelines.
- Support colleagues with peer review and knowledge sharing.
- Monitor and dissect global threat streams, technical disclosures and campaign data to extract malicious behaviors and techniques (TTPs).
- Execute automated environment-check playbooks against centralized SIEM and data lake logs to establish enterprise exposure during emerging threat events.
- Compile high-fidelity Proactive Operational Packs (POPs) that deliver verified asset blast radius, adjusted risk profiles and pre-validated context to defenders.
- Leverage generative AI query and prompting frameworks to rapidly draft proactive behavioral detection logic for validation and deployment.
- Build and maintain the metrics that show whether the Cyber Defense function is getting ahead of threat activity.
- Partner with detection engineering, threat intelligence and threat exposure management to close predicted gaps.
- Establish the operating model for Proactive Defense Operations and mature it over time.
Basic Qualifications:
- Degree in a relevant discipline, or related experience.
- Demonstrated experience in security operations, detection engineering or security data science.
- Proficient in using centralized telemetry interfaces (SIEM, EDR, cloud logs) to run complex, multi-variable queries.
- 4+ years of hands-on experience in technical Cyber Defense, Threat Hunting or advanced Security Operations.
- Demonstrated ability to deliver work independently to a high standard.
- Strong attention to detail in analysis and documentation.
Preferred Qualifications:
- Experience with security data science, modelling or advanced analytics.
- Familiarity with MITRE ATT&CK and threat-informed defence practice.
- Experience with generative AI query and prompting frameworks for detection logic drafting.
- Data engineering or Python analytics skill.
- Relevant certification such as CISSP, GCIA, GCDA, GCTI.
- Experience in pharmaceutical, life sciences or another highly regulated industry.