As a Cyber Defence Analyst, you will join the Cyber Fusion Center, performing in depth analysis, assessment, and response to security threats by following documented policies to meet Service Level Goals. The team provides global 24x7 security operations and monitoring for cybersecurity events affecting Experian. You will be a part of the first line of defence in Experian's broader incident response and incident management departments, responsible for receiving and prioritizing cybersecurity alerts, including being the dedicated contact for potential security incidents reported by users (e.g., Experian employees). Depending on the results of assessment, this team is then responsible for investigating, containing, eradicating, and recovering from events falling in its scope or escalating higher risk events to dedicated incident response and management teams in the CFC. This role is critical in ensuring the handling of potential threats and plays a part in improving security operations. This is a home based role reporting to the Director of Security Operations for SecOps & Threat Detection. Please note that in this role, you will have an 8x5 Monday Friday schedule, with flexibility to respond to after hours pages for potentially major security incidents to support incident response efforts and may include assignment to an on call rotation for evenings, weekends, holidays. Summary of Primary Responsibilities As the Cyber Defence Analyst, you will: Contribute to daily security operations by overseeing response activities for security events and alerts associated with cyber threats, intrusions, and compromises alongside a team of global security analysts following documented SLOs and processes. Analyze events using security tooling and logging (e.g., SIEM, EDR) and assess potential risk / severity level of cyber threats; elevate higher risk events to dedicated incident response and management teams in the CFC according to established processes. Collaborate with external teams for incident resolution and escalations, driving incident handling. Notify team Lead(s) of concerns related to operations, such as anomalous changes in metrics, notable open incidents, quality concerns, or observed risks; support with resolution if appropriate. Manage and complete assigned caseload throughout the incident response lifecycle, including analysis, containment, eradication, recovery, and lessons learned. Maintain all case documentation, including notes, analysis findings, containment steps, and cause for each assigned security incident. Ensure incident updates or contact with end users are performed promptly and documented. Help improve relevant strategies, Standard Operating Procedures (SOPs), and training materials. Support management's overall strategy for CFC by participating in execution of improvement programs together with management's plans. Assist the team Leads and management on use case development by suggesting enhancement or tuning of use cases to improve the security posture of Experian. About Experian Experian is a global data and technology company, powering opportunities for people and businesses around the world. We help to redefine lending practices, uncover and prevent fraud, simplify healthcare, create marketing solutions, and gain deeper insights into the automotive market, all using our unique combination of data, analytics and software. We also assist millions of people to accomplish their financial goals and help them save time and money. We operate across a range of markets, from financial services to healthcare, automotive, agribusiness, insurance, and many more industry segments. We invest in people and new advanced technologies to unlock the power of data. As a FTSE 100 Index company listed on the London Stock Exchange (EXPN), we have a team of 22,500 people across 32 countries. Our corporate headquarters are in Dublin, Ireland. Learn more at Internal Grade E Experience and Skills Some information security experience working within a Security Operations Center or Cyber Security Incident Response Teams. Bachelor's Degree in Computer Science, Computer Engineering, Information Systems, Information Security or professional certification related to Digital Forensics, Incident Response, or Ethical Hacking (e.g., GCIH, CEH, GCFE, GCFA, and CFCE). Knowledge of main concepts related to the Incident Response Life Cycle, MITRE ATT&CK Framework, Cyber Kill Chain, and other cybersecurity frameworks. High level understanding of common intrusion methods and cyber attack tactics, techniques, and procedures (TTPs), and common industry recommendations to prevent and respond to threats such as phishing, malware, network attacks, suspicious activity, data security incidents. Exposure to technical elements of common Operating Systems (Windows, Linux, Mac OS), Networking (Firewalls, Proxies, NetFlow), Cloud Infrastructure (AWS, Azure, GCP), and Security Technologies (Anti Virus, Intrusion Prevention, Web Application Firewalls). Interest in developing knowledge across common Incident Response and Security Monitoring applications such as SIEM (e.g., Qradar, Splunk), EDR (e.g., FireEye HX, CrowdStrike Falcon, Microsoft Defender), and SOAR (Palo Alto XSOAR, Google Secops / Chronicle). Desire to build technical skills and hands on knowledge in the following areas of security operations and incident response In depth packet analysis skills, core forensic familiarity, incident response skills, public cloud security practices, and data fusion skills based on multiple security data sources. Security analysis and architecture of Azure and AWS cloud environment using security tools including Defender for Cloud, GuardDuty, CloudTrail, or CloudWatch. System administration on Unix, Linux, or Windows. Network forensics, logging, and event management. Defensive network infrastructure (operations or engineering). Vulnerability assessment and penetration testing concepts. Malware analysis concepts, techniques, and reverse engineering. In depth knowledge of network and host security technologies and products (such as firewalls, network IDS, scanners) and improve these skills. Security monitoring technologies, such as SIEM, IPS/IDS, UEBA, DLP, among others. Scripting and automation. Additional Information Benefits package includes: Flexible work environment, working hybrid or in the office if you prefer. Great compensation package and discretionary bonus plan. Core benefits include pension, bupa healthcare, sharesave scheme and more. 25 days annual leave with 8 bank holidays and 3 volunteering days. You can purchase additional annual leave. Experian is proud to be an Equal Opportunity and affirmative Action employer. Innovation is an important part of Experian's DNA and practices, and our diverse workforce drives our success. Everyone can succeed at Experian and bring their whole self to work, irrespective of their gender, ethnicity, religion, colour, sexuality, physical ability or age. If you have a disability or special need that requires accommodation, please let us know at the earliest opportunity. Experian Careers - Creating a better tomorrow together. Find out what its like to work for Experian by clicking here.
Jan 01, 2026
Full time
As a Cyber Defence Analyst, you will join the Cyber Fusion Center, performing in depth analysis, assessment, and response to security threats by following documented policies to meet Service Level Goals. The team provides global 24x7 security operations and monitoring for cybersecurity events affecting Experian. You will be a part of the first line of defence in Experian's broader incident response and incident management departments, responsible for receiving and prioritizing cybersecurity alerts, including being the dedicated contact for potential security incidents reported by users (e.g., Experian employees). Depending on the results of assessment, this team is then responsible for investigating, containing, eradicating, and recovering from events falling in its scope or escalating higher risk events to dedicated incident response and management teams in the CFC. This role is critical in ensuring the handling of potential threats and plays a part in improving security operations. This is a home based role reporting to the Director of Security Operations for SecOps & Threat Detection. Please note that in this role, you will have an 8x5 Monday Friday schedule, with flexibility to respond to after hours pages for potentially major security incidents to support incident response efforts and may include assignment to an on call rotation for evenings, weekends, holidays. Summary of Primary Responsibilities As the Cyber Defence Analyst, you will: Contribute to daily security operations by overseeing response activities for security events and alerts associated with cyber threats, intrusions, and compromises alongside a team of global security analysts following documented SLOs and processes. Analyze events using security tooling and logging (e.g., SIEM, EDR) and assess potential risk / severity level of cyber threats; elevate higher risk events to dedicated incident response and management teams in the CFC according to established processes. Collaborate with external teams for incident resolution and escalations, driving incident handling. Notify team Lead(s) of concerns related to operations, such as anomalous changes in metrics, notable open incidents, quality concerns, or observed risks; support with resolution if appropriate. Manage and complete assigned caseload throughout the incident response lifecycle, including analysis, containment, eradication, recovery, and lessons learned. Maintain all case documentation, including notes, analysis findings, containment steps, and cause for each assigned security incident. Ensure incident updates or contact with end users are performed promptly and documented. Help improve relevant strategies, Standard Operating Procedures (SOPs), and training materials. Support management's overall strategy for CFC by participating in execution of improvement programs together with management's plans. Assist the team Leads and management on use case development by suggesting enhancement or tuning of use cases to improve the security posture of Experian. About Experian Experian is a global data and technology company, powering opportunities for people and businesses around the world. We help to redefine lending practices, uncover and prevent fraud, simplify healthcare, create marketing solutions, and gain deeper insights into the automotive market, all using our unique combination of data, analytics and software. We also assist millions of people to accomplish their financial goals and help them save time and money. We operate across a range of markets, from financial services to healthcare, automotive, agribusiness, insurance, and many more industry segments. We invest in people and new advanced technologies to unlock the power of data. As a FTSE 100 Index company listed on the London Stock Exchange (EXPN), we have a team of 22,500 people across 32 countries. Our corporate headquarters are in Dublin, Ireland. Learn more at Internal Grade E Experience and Skills Some information security experience working within a Security Operations Center or Cyber Security Incident Response Teams. Bachelor's Degree in Computer Science, Computer Engineering, Information Systems, Information Security or professional certification related to Digital Forensics, Incident Response, or Ethical Hacking (e.g., GCIH, CEH, GCFE, GCFA, and CFCE). Knowledge of main concepts related to the Incident Response Life Cycle, MITRE ATT&CK Framework, Cyber Kill Chain, and other cybersecurity frameworks. High level understanding of common intrusion methods and cyber attack tactics, techniques, and procedures (TTPs), and common industry recommendations to prevent and respond to threats such as phishing, malware, network attacks, suspicious activity, data security incidents. Exposure to technical elements of common Operating Systems (Windows, Linux, Mac OS), Networking (Firewalls, Proxies, NetFlow), Cloud Infrastructure (AWS, Azure, GCP), and Security Technologies (Anti Virus, Intrusion Prevention, Web Application Firewalls). Interest in developing knowledge across common Incident Response and Security Monitoring applications such as SIEM (e.g., Qradar, Splunk), EDR (e.g., FireEye HX, CrowdStrike Falcon, Microsoft Defender), and SOAR (Palo Alto XSOAR, Google Secops / Chronicle). Desire to build technical skills and hands on knowledge in the following areas of security operations and incident response In depth packet analysis skills, core forensic familiarity, incident response skills, public cloud security practices, and data fusion skills based on multiple security data sources. Security analysis and architecture of Azure and AWS cloud environment using security tools including Defender for Cloud, GuardDuty, CloudTrail, or CloudWatch. System administration on Unix, Linux, or Windows. Network forensics, logging, and event management. Defensive network infrastructure (operations or engineering). Vulnerability assessment and penetration testing concepts. Malware analysis concepts, techniques, and reverse engineering. In depth knowledge of network and host security technologies and products (such as firewalls, network IDS, scanners) and improve these skills. Security monitoring technologies, such as SIEM, IPS/IDS, UEBA, DLP, among others. Scripting and automation. Additional Information Benefits package includes: Flexible work environment, working hybrid or in the office if you prefer. Great compensation package and discretionary bonus plan. Core benefits include pension, bupa healthcare, sharesave scheme and more. 25 days annual leave with 8 bank holidays and 3 volunteering days. You can purchase additional annual leave. Experian is proud to be an Equal Opportunity and affirmative Action employer. Innovation is an important part of Experian's DNA and practices, and our diverse workforce drives our success. Everyone can succeed at Experian and bring their whole self to work, irrespective of their gender, ethnicity, religion, colour, sexuality, physical ability or age. If you have a disability or special need that requires accommodation, please let us know at the earliest opportunity. Experian Careers - Creating a better tomorrow together. Find out what its like to work for Experian by clicking here.
Role: Senior Technical Threat Intelligence Analyst Who You Are You are a research-minded threat intelligence professional with experience of analysing and tracking threat campaigns, adversary tooling and infrastructure. You stay abreast of the latest threats, recognize the value of intelligence, and believe it should drive operations. You are a devoted team member who is always willing to lend a hand, mentor a colleague, or increase our global team's awareness by sharing your knowledge and approaches with others. Key Responsibilities Independent and collaborative production of intelligence alerts and intelligence research products. Production of ad-hoc cyber threat intelligence alerts and reports aimed at meeting client requirements. Deep dive analysis of threats facing Accenture clients. Contribution to the team's overall delivery effectiveness and efficiency, such as by contributing to analyst workflow automation, developing new tools, and improving existing delivery methodologies. Supporting the ACI Consulting and ACI Managed Services teams, Readiness and Testing, Cyber Response and Recovery, and Security Operations/MxDR functions with up-to-date technical intelligence, detection logic and situational awareness on current and emerging threats. Qualifications Degree or equivalent qualifications, preferably relating to politics, intelligence, information technology or information security OR equivalent knowledge through apprenticeship, vocational training or work experience. Minimum 2 years of experience in technical threat intelligence or an adjacent role. Required Skills Ability to work with geographically dispersed teams. Strong analytical skills. Knowledge of open-source intelligence collection, and processing and analysis of multiple data sources, most of which are open source. Familiarity using threat intelligence, data analysis or technical analysis tools and platforms. Familiarity of using common threat intelligence frameworks (e.g., MITRE ATT&CK, Diamond Model) in intelligence reporting. Experience in tracking adversary infrastructure, intrusions, and malware campaign activity. Ability to work as part of a team and independently with minimal supervision. Ability to conduct quality assurance and provide feedback. Ability to produce intelligence products for varied audiences (e.g., tactical, operational, strategic). Experience in a similar role. Desired Skills Experience in conducting Attack Surface Assessment or Dark Web research. Experience with Intelligence Led Penetration Testing (ILPT) frameworks such as CREST STAR TI, CBEST, GBEST, TIBER-EU, CORIE, iCAST or AASE. Understanding of geopolitical landscape and how real-world events and geopolitics influence cyber activity. Experience in project management or leading peers during engagements. Experience delivering presentations and managing client relations. Ability to obtain and hold national security clearance. CREST Registered Threat Intelligence Analyst, SANS FOR578 or equivalent qualifications. Optional Discipline Highlights International Relations, Politics, Criminology, English, Sociology. Academic research, journalism. Cyber security, Incident Response, Penetration testing, Security Operations or Systems Administration. Software development. Military intelligence.
Jan 01, 2026
Full time
Role: Senior Technical Threat Intelligence Analyst Who You Are You are a research-minded threat intelligence professional with experience of analysing and tracking threat campaigns, adversary tooling and infrastructure. You stay abreast of the latest threats, recognize the value of intelligence, and believe it should drive operations. You are a devoted team member who is always willing to lend a hand, mentor a colleague, or increase our global team's awareness by sharing your knowledge and approaches with others. Key Responsibilities Independent and collaborative production of intelligence alerts and intelligence research products. Production of ad-hoc cyber threat intelligence alerts and reports aimed at meeting client requirements. Deep dive analysis of threats facing Accenture clients. Contribution to the team's overall delivery effectiveness and efficiency, such as by contributing to analyst workflow automation, developing new tools, and improving existing delivery methodologies. Supporting the ACI Consulting and ACI Managed Services teams, Readiness and Testing, Cyber Response and Recovery, and Security Operations/MxDR functions with up-to-date technical intelligence, detection logic and situational awareness on current and emerging threats. Qualifications Degree or equivalent qualifications, preferably relating to politics, intelligence, information technology or information security OR equivalent knowledge through apprenticeship, vocational training or work experience. Minimum 2 years of experience in technical threat intelligence or an adjacent role. Required Skills Ability to work with geographically dispersed teams. Strong analytical skills. Knowledge of open-source intelligence collection, and processing and analysis of multiple data sources, most of which are open source. Familiarity using threat intelligence, data analysis or technical analysis tools and platforms. Familiarity of using common threat intelligence frameworks (e.g., MITRE ATT&CK, Diamond Model) in intelligence reporting. Experience in tracking adversary infrastructure, intrusions, and malware campaign activity. Ability to work as part of a team and independently with minimal supervision. Ability to conduct quality assurance and provide feedback. Ability to produce intelligence products for varied audiences (e.g., tactical, operational, strategic). Experience in a similar role. Desired Skills Experience in conducting Attack Surface Assessment or Dark Web research. Experience with Intelligence Led Penetration Testing (ILPT) frameworks such as CREST STAR TI, CBEST, GBEST, TIBER-EU, CORIE, iCAST or AASE. Understanding of geopolitical landscape and how real-world events and geopolitics influence cyber activity. Experience in project management or leading peers during engagements. Experience delivering presentations and managing client relations. Ability to obtain and hold national security clearance. CREST Registered Threat Intelligence Analyst, SANS FOR578 or equivalent qualifications. Optional Discipline Highlights International Relations, Politics, Criminology, English, Sociology. Academic research, journalism. Cyber security, Incident Response, Penetration testing, Security Operations or Systems Administration. Software development. Military intelligence.
Location: Stevenage (onsite / shift patterns) Duration: 6 month initial contract Rate: 45ph UMB to 66ph UMB (Inside IR35) Due to the nature of the role, candidates must be eligible for UK Eyes Only Security Clearance. Role details: Our client, a leading defence company, are looking for a SOC Analyst to join their team in Stevenage. The successful applicant will drive a proactive ethos in an ever-changing cyber security environment and provide robust threat detection and analysis within the 24x7 SOC. Responsibilities: This role will cover analysis, monitoring, reporting, alerting and investigation activity utilising a wide variety of security platforms including AI/ML and behavioural analytics, SIEM (Security Information Event Management), Network Packet Capture platform, Anti Malicious Code, Threat Detection technologies and platforms across the UK Network Perimeter working with the best standard technologies. Effective Tier 1 to 2 alert triage of security events Monitoring of Cyber Security tools Monitoring the SOC email notification mailboxes Assists with the maintenance of MBDA Security technologies Assisting the SOC Solutions Lead with project activity Assist proactive threat hunting in collaboration with the CTI function Assist IR in HR and InfoSec related investigations Ensure the timely triage and remediation of any incident or request tickets raised to the SOC Participate in the activity of adding/removing URLs from the AcceptList and BlockList Attend routine security meetings Conduct activities in line with SOC Maturity and continuous improvement What we are looking for in you: A career background in Cyber Security. Security awareness and experience in all areas of IT, primarily Network Security, Infrastructure and the secondary area being Operating Systems & Applications. Knowledge of IT Security standard methodologies. Demonstrable understanding of the OSI Reference Model and the network communication protocols, including but not limited to DNS, HTTP/S, SSL, SMTP, FTP/S, LDAP/S. Demonstrable experience with Security Information Event Monitoring Tools and/or Network Packet Capture tools. Hands on experience with IDS/IPS technologies and threat hunting activities. Strong analytical experience and mind-set. Experience within Defensive Cyber-attack methodologies and frameworks. Understanding of Malware capabilities, attack vectors, propagation and impact. Good communication skills liaising with the business and suppliers. Desirable Skillset/experience (Senior grade): Root cause analysis and leading T2 incident investigations Process / Playbook / Runbook development Working knowledge of detection engineering, false positive improvements Capability to tune SIEM rules or create custom detections Scripted automation experience e.g. Python, SOAR, PowerShell Threat modelling and Hunting methodologies Note, shift patterns applicable. (The shift pattern rotates each cycle - it may start with lates -> Nights -> earlies and the next cycle could be: Nights -> earlies -> lates). Initially you may not be expected to do nights until the team grows. 31.5 hours per week Apply today via the link provided!
Jan 01, 2026
Contractor
Location: Stevenage (onsite / shift patterns) Duration: 6 month initial contract Rate: 45ph UMB to 66ph UMB (Inside IR35) Due to the nature of the role, candidates must be eligible for UK Eyes Only Security Clearance. Role details: Our client, a leading defence company, are looking for a SOC Analyst to join their team in Stevenage. The successful applicant will drive a proactive ethos in an ever-changing cyber security environment and provide robust threat detection and analysis within the 24x7 SOC. Responsibilities: This role will cover analysis, monitoring, reporting, alerting and investigation activity utilising a wide variety of security platforms including AI/ML and behavioural analytics, SIEM (Security Information Event Management), Network Packet Capture platform, Anti Malicious Code, Threat Detection technologies and platforms across the UK Network Perimeter working with the best standard technologies. Effective Tier 1 to 2 alert triage of security events Monitoring of Cyber Security tools Monitoring the SOC email notification mailboxes Assists with the maintenance of MBDA Security technologies Assisting the SOC Solutions Lead with project activity Assist proactive threat hunting in collaboration with the CTI function Assist IR in HR and InfoSec related investigations Ensure the timely triage and remediation of any incident or request tickets raised to the SOC Participate in the activity of adding/removing URLs from the AcceptList and BlockList Attend routine security meetings Conduct activities in line with SOC Maturity and continuous improvement What we are looking for in you: A career background in Cyber Security. Security awareness and experience in all areas of IT, primarily Network Security, Infrastructure and the secondary area being Operating Systems & Applications. Knowledge of IT Security standard methodologies. Demonstrable understanding of the OSI Reference Model and the network communication protocols, including but not limited to DNS, HTTP/S, SSL, SMTP, FTP/S, LDAP/S. Demonstrable experience with Security Information Event Monitoring Tools and/or Network Packet Capture tools. Hands on experience with IDS/IPS technologies and threat hunting activities. Strong analytical experience and mind-set. Experience within Defensive Cyber-attack methodologies and frameworks. Understanding of Malware capabilities, attack vectors, propagation and impact. Good communication skills liaising with the business and suppliers. Desirable Skillset/experience (Senior grade): Root cause analysis and leading T2 incident investigations Process / Playbook / Runbook development Working knowledge of detection engineering, false positive improvements Capability to tune SIEM rules or create custom detections Scripted automation experience e.g. Python, SOAR, PowerShell Threat modelling and Hunting methodologies Note, shift patterns applicable. (The shift pattern rotates each cycle - it may start with lates -> Nights -> earlies and the next cycle could be: Nights -> earlies -> lates). Initially you may not be expected to do nights until the team grows. 31.5 hours per week Apply today via the link provided!
SOC Analyst page is loaded SOC Analystlocations: Manchester: Cheltenham: Londonposted on: Posted 2 Days Agojob requisition id: R9846 SOC Analyst Hybrid (Manchester, Cheltenham or London) Role Purpose Today, it is an unavoidable fact that your business-critical infrastructure and systems are at risk of attack. The key to good security is a clear understanding of what is most critical to the business. Where you do not have enough internal resources, time or skills to monitor and manage your IT environment 24/7, NCC Group can help, freeing up your skilled employees to focus on value-add activity.NCC Group provide a range of managed and hosted services delivered from our UK based Security Operations Centre SOC which operates 24/7, 365 days a year. Our team of over 30 accredited security experts are available 24/7, dealing daily with over 200 million log events and providing support for over 5,000 network devices.We are specialists in SIEM, our services backed by our EDGE methodology built up through dozens of major deployments and hundreds of use cases with many of the UK's largest companies. We are the UK's largest DDI service provider and the leading integrator for Carbon Black, Splunk, Log Rhythm, Defender ATP and Azure Sentinel in the UK.We provide a single point of contact for all of your managed security needs and can work with you to define and achieve you own individual security requirements. Our team of experts provide proactive monitoring and reporting, monitoring your equipment to ensure maximum availability and responding to calls to support change requests and helping diagnose system issues.Read more about the services offered by the NCC Group Security Operations Centre here: Summary Monitor global IDS, Network Intruder, Firewall, DDoS detection and mitigation, availability and SIEM platforms looking for potential threats, vulnerabilities and indicators of compromise. Provide Incident remediation and prevention documentation and recommendations to customers based on defined procedures and analyst experience. Document and conform to processes related to security monitoring procedures. Provide customer service that exceeds our customers' expectations at all times. Initiate escalation procedure to counteract potential threats, vulnerabilities and threat actors. Compilation and review of service focused reporting. Act as an escalation point for more junior members of the team, providing assistance and mentoring where necessary. Providing assistance to Senior SOC Analysts on Threat Hunting engagements. Contributing to the continuous improvement of SOC procedures and documentation. Perform other duties as assigned. What we are looking for in you Experience / Skills Practical knowledge of security and networking toolsets such as SIEM, IDS, Vulnerability Management, Availability Monitoring, packet capture and other threat detection technologies. Pre-existing, in-depth knowledge of common network protocols. Pre-existing, in-depth knowledge of Windows and Linux based operating systems. Experience in the extensive analysis of common security incidents. Ability to stay calm in highly sensitive and high-pressure incidents. Experience with LogRhythm, ArcSight or Splunk is desirable but not required.CertificationsThe following certifications are desirable, but not a requirement. Successful candidates that do not possess thesecertifications may be tasked with working towards them at the beginning of their employment: CREST CPSA / CRIA / CMRE / CNIA / CHIA CompTIA Security+ CompTIA Network+ Degree in related field. Other relevant certifications. Ways of working Focusing on Clients and Customers. Working as One NCC.Always Learning.Being Inclusive and Respectful.Delivering Brilliantly. Our company At NCC Group, our mission is to create a more secure digital future. That mission underpins everything we do, from our work with our incredible clients to groundbreaking research shaping our industry. Our teams' partner with clients across a multitude of industries, delving into, securing new products, and emerging technologies, as well as solving complex security problems. As global leaders in cyber and escrow, NCC Group is a people-powered business seeking the next group of brilliant minds to join our ranks. Our colleagues are our greatest asset, and NCC Group is committed to providing an inclusive and supportive work environment that fosters creativity, collaboration, authenticity, and accountability. We want colleagues to put down roots at NCC Group, and we offer a comprehensive benefits package, as well as opportunities for learning and development and career growth. We believe our people are at their brilliant best when they feel bolstered in all aspects of their well-being, and we offer wellness programs and flexible working arrangements to provide that vital support.We have a high-performance culture which is balanced evenly with world-class well-being initiatives and benefits:Flexible working Financial & InvestmentPensionLife AssuranceShare Save SchemeMaternity & Paternity leaveCommunity & Volunteering Programmes Green Car Scheme Cycle Scheme Employee Referral Program Lifestyle & Wellness Learning & Development Diversity & Inclusion If this sounds like the right opportunity for you, then we would love to hear from you! Click on apply to this job to send us your CV and cover letter and the relevant member of our global talent team will be in touch with you. Alternatively send your details to . About your application We review every application received and will get in touch if your skills and experience match what we're looking for. If you don't hear back from us within 10 days, please don't be too disappointed - we may keep your CV on our database for any future vacancies and we would encourage you to keep an eye on our career opportunities as there may be other suitable roles.If you do not want us to retain your details, please email . All personal data is held in accordance with the NCC Group Privacy Policy (). We are committed to diversity and flexibility in the workplace. If you require any reasonable adjustments to support you during the application process, please tell us at any stage. Please note that this role involves mandatory pre-employment background checks due to the nature of the work NCC Group does. To apply, you must be willing and able to undergo the vetting process. This role being advertised will be subject to BS7858 screening as a mandatory requirement.
Jan 01, 2026
Full time
SOC Analyst page is loaded SOC Analystlocations: Manchester: Cheltenham: Londonposted on: Posted 2 Days Agojob requisition id: R9846 SOC Analyst Hybrid (Manchester, Cheltenham or London) Role Purpose Today, it is an unavoidable fact that your business-critical infrastructure and systems are at risk of attack. The key to good security is a clear understanding of what is most critical to the business. Where you do not have enough internal resources, time or skills to monitor and manage your IT environment 24/7, NCC Group can help, freeing up your skilled employees to focus on value-add activity.NCC Group provide a range of managed and hosted services delivered from our UK based Security Operations Centre SOC which operates 24/7, 365 days a year. Our team of over 30 accredited security experts are available 24/7, dealing daily with over 200 million log events and providing support for over 5,000 network devices.We are specialists in SIEM, our services backed by our EDGE methodology built up through dozens of major deployments and hundreds of use cases with many of the UK's largest companies. We are the UK's largest DDI service provider and the leading integrator for Carbon Black, Splunk, Log Rhythm, Defender ATP and Azure Sentinel in the UK.We provide a single point of contact for all of your managed security needs and can work with you to define and achieve you own individual security requirements. Our team of experts provide proactive monitoring and reporting, monitoring your equipment to ensure maximum availability and responding to calls to support change requests and helping diagnose system issues.Read more about the services offered by the NCC Group Security Operations Centre here: Summary Monitor global IDS, Network Intruder, Firewall, DDoS detection and mitigation, availability and SIEM platforms looking for potential threats, vulnerabilities and indicators of compromise. Provide Incident remediation and prevention documentation and recommendations to customers based on defined procedures and analyst experience. Document and conform to processes related to security monitoring procedures. Provide customer service that exceeds our customers' expectations at all times. Initiate escalation procedure to counteract potential threats, vulnerabilities and threat actors. Compilation and review of service focused reporting. Act as an escalation point for more junior members of the team, providing assistance and mentoring where necessary. Providing assistance to Senior SOC Analysts on Threat Hunting engagements. Contributing to the continuous improvement of SOC procedures and documentation. Perform other duties as assigned. What we are looking for in you Experience / Skills Practical knowledge of security and networking toolsets such as SIEM, IDS, Vulnerability Management, Availability Monitoring, packet capture and other threat detection technologies. Pre-existing, in-depth knowledge of common network protocols. Pre-existing, in-depth knowledge of Windows and Linux based operating systems. Experience in the extensive analysis of common security incidents. Ability to stay calm in highly sensitive and high-pressure incidents. Experience with LogRhythm, ArcSight or Splunk is desirable but not required.CertificationsThe following certifications are desirable, but not a requirement. Successful candidates that do not possess thesecertifications may be tasked with working towards them at the beginning of their employment: CREST CPSA / CRIA / CMRE / CNIA / CHIA CompTIA Security+ CompTIA Network+ Degree in related field. Other relevant certifications. Ways of working Focusing on Clients and Customers. Working as One NCC.Always Learning.Being Inclusive and Respectful.Delivering Brilliantly. Our company At NCC Group, our mission is to create a more secure digital future. That mission underpins everything we do, from our work with our incredible clients to groundbreaking research shaping our industry. Our teams' partner with clients across a multitude of industries, delving into, securing new products, and emerging technologies, as well as solving complex security problems. As global leaders in cyber and escrow, NCC Group is a people-powered business seeking the next group of brilliant minds to join our ranks. Our colleagues are our greatest asset, and NCC Group is committed to providing an inclusive and supportive work environment that fosters creativity, collaboration, authenticity, and accountability. We want colleagues to put down roots at NCC Group, and we offer a comprehensive benefits package, as well as opportunities for learning and development and career growth. We believe our people are at their brilliant best when they feel bolstered in all aspects of their well-being, and we offer wellness programs and flexible working arrangements to provide that vital support.We have a high-performance culture which is balanced evenly with world-class well-being initiatives and benefits:Flexible working Financial & InvestmentPensionLife AssuranceShare Save SchemeMaternity & Paternity leaveCommunity & Volunteering Programmes Green Car Scheme Cycle Scheme Employee Referral Program Lifestyle & Wellness Learning & Development Diversity & Inclusion If this sounds like the right opportunity for you, then we would love to hear from you! Click on apply to this job to send us your CV and cover letter and the relevant member of our global talent team will be in touch with you. Alternatively send your details to . About your application We review every application received and will get in touch if your skills and experience match what we're looking for. If you don't hear back from us within 10 days, please don't be too disappointed - we may keep your CV on our database for any future vacancies and we would encourage you to keep an eye on our career opportunities as there may be other suitable roles.If you do not want us to retain your details, please email . All personal data is held in accordance with the NCC Group Privacy Policy (). We are committed to diversity and flexibility in the workplace. If you require any reasonable adjustments to support you during the application process, please tell us at any stage. Please note that this role involves mandatory pre-employment background checks due to the nature of the work NCC Group does. To apply, you must be willing and able to undergo the vetting process. This role being advertised will be subject to BS7858 screening as a mandatory requirement.
By contacting us, you agree with the storage and handling of your data by this website. Please view the terms of our policy here . Job Description: We are seeking experienced Cyber Security Consultants to join a growing London-based team within a fast-growing company in the Managed Security Service Provider (MSSP) market. As a Cybersecurity Consultant, you'll be providing cutting-edge cybersecurity solutions to clients across the globe and will be responsible for overseeing Security Operations and ensuring the highest level of security for the customer. The Cyber Security Consultant leads detailed risk assessments, implements industry-standard frameworks (NIST, NCSC, NIS2), and actively manages SIEM/XDR tools such as IBM QRadar, Microsoft Sentinel, and Defender XDR. This role involves deeper client interaction, proactive risk management, and advanced threat detection consulting. Candidates must have demonstrated customer-facing experience (preferably in cybersecurity). Responsibilities: Manage and strengthen client relationships with regular strategic interactions. Lead comprehensive cybersecurity risk assessments aligned to industry standards. Conduct environment reviews, ensuring compliance with NIST frameworks and related standards. Oversee and implement SIEM/XDR deployments, custom rule development, and incident response processes. Provide guidance on best practices for SIEM/XDR and threat detection. Conduct security posture reviews and gap analysis. Prepare reports and present findings to client stakeholders. Location London, UK Good understanding of cybersecurity frameworks (NIST CSF, NCSC CAF, NIS2, NIST 800-30). Good understanding of risk assessment methodologies (NIST 800-30). Hands-on experience with SIEM/XDR solutions (QRadar, Sentinel, Defender XDR). Familiarity with cloud security principles across AWS, Azure, and GCP, particularly within managed services environments. Additional Skills: Proven experience within IT Support, Infrastructure, and/or IT Engineering and stakeholder engagement. Excellent verbal and written communication skills, as you will be interacting with clients and presenting to senior stakeholders from across the globe. Relationship building, critical problem solving, and effective communication skills. Experiences: Experience: 2 - 5 Years. Required: CompTIA Security+ or CySA+. Desirable: Microsoft Certified Security Operations Analyst Associate, EC-Council ECIH (Incident Handling), Multi-cloud Security Fundamentals training (AWS/Azure/GCP). Empowering CISOs to visualise and mitigate cyber risks. Construction Threat Landscape Report 2024 Global Threat Insight Summer Report 2024 MITRE Engenuity ATT&CK Evaluations & The Question of How to Measure Quality in a Managed Security Service
Jan 01, 2026
Full time
By contacting us, you agree with the storage and handling of your data by this website. Please view the terms of our policy here . Job Description: We are seeking experienced Cyber Security Consultants to join a growing London-based team within a fast-growing company in the Managed Security Service Provider (MSSP) market. As a Cybersecurity Consultant, you'll be providing cutting-edge cybersecurity solutions to clients across the globe and will be responsible for overseeing Security Operations and ensuring the highest level of security for the customer. The Cyber Security Consultant leads detailed risk assessments, implements industry-standard frameworks (NIST, NCSC, NIS2), and actively manages SIEM/XDR tools such as IBM QRadar, Microsoft Sentinel, and Defender XDR. This role involves deeper client interaction, proactive risk management, and advanced threat detection consulting. Candidates must have demonstrated customer-facing experience (preferably in cybersecurity). Responsibilities: Manage and strengthen client relationships with regular strategic interactions. Lead comprehensive cybersecurity risk assessments aligned to industry standards. Conduct environment reviews, ensuring compliance with NIST frameworks and related standards. Oversee and implement SIEM/XDR deployments, custom rule development, and incident response processes. Provide guidance on best practices for SIEM/XDR and threat detection. Conduct security posture reviews and gap analysis. Prepare reports and present findings to client stakeholders. Location London, UK Good understanding of cybersecurity frameworks (NIST CSF, NCSC CAF, NIS2, NIST 800-30). Good understanding of risk assessment methodologies (NIST 800-30). Hands-on experience with SIEM/XDR solutions (QRadar, Sentinel, Defender XDR). Familiarity with cloud security principles across AWS, Azure, and GCP, particularly within managed services environments. Additional Skills: Proven experience within IT Support, Infrastructure, and/or IT Engineering and stakeholder engagement. Excellent verbal and written communication skills, as you will be interacting with clients and presenting to senior stakeholders from across the globe. Relationship building, critical problem solving, and effective communication skills. Experiences: Experience: 2 - 5 Years. Required: CompTIA Security+ or CySA+. Desirable: Microsoft Certified Security Operations Analyst Associate, EC-Council ECIH (Incident Handling), Multi-cloud Security Fundamentals training (AWS/Azure/GCP). Empowering CISOs to visualise and mitigate cyber risks. Construction Threat Landscape Report 2024 Global Threat Insight Summer Report 2024 MITRE Engenuity ATT&CK Evaluations & The Question of How to Measure Quality in a Managed Security Service
Methods Business and Digital Technology
Ledbury, Herefordshire
A leading IT Services Consultancy in Ledbury is looking for a Cyber Analyst. This role requires expertise in Elastic Stack and Azure & Sentinel, along with a strong focus on Security Operations. The successful candidate will develop detection rules, manage log pipelines, and communicate effectively with clients and stakeholders throughout the security operations process. Eligibility for SC and/or DV clearance is required.
Jan 01, 2026
Full time
A leading IT Services Consultancy in Ledbury is looking for a Cyber Analyst. This role requires expertise in Elastic Stack and Azure & Sentinel, along with a strong focus on Security Operations. The successful candidate will develop detection rules, manage log pipelines, and communicate effectively with clients and stakeholders throughout the security operations process. Eligibility for SC and/or DV clearance is required.
About Us Turnkey Consulting is an independent risk and security consultancy that brings together people, protection, and performance to help organisations achieve Digital Enterprise Resilience. For more than 20 years, Turnkey has enabled the world's leading companies to understand and optimise their risk and security landscape through assessment-based road mapping, organisational empowerment, and expert application of market-leading technologies. Turnkey is headquartered in London with offices across Asia, Australia, Europe, and North America. Role Overview We are seeking an experienced individual with a strong foundation in SAP Vulnerability Management and Threat Detection systems, including associated controls, proficiency in SAP environments, and awareness of Cybersecurity frameworks. Key Responsibilities Design, implement, and assess vulnerability management frameworks, primarily within SAP-enabled environments. Lead client conversations on SAP Vulnerability and Threat Management strategy, compliance challenges, and controls optimisation. Provide insight on Information Security frameworks (OWASP/NIST/NIS2 etc.) and the Secure Operations Map, helping communicate regulatory or good practice obligations and actionable solutions. Manage and mentor junior consultants and analysts to aid a high-performance team culture. Support business development activities, including scoping, proposal development, and client pitches throughout the sales lifecycle. Build long-term relationships with clients as a trusted advisor in controls and compliance. Required Core Behaviours Ability to focus on the "why" of our solutions, not just the how. Demonstrable experience in prioritising the client's objectives. Passionate about improving the perception of the industry towards a more business growth enabling function. Demonstrable ability to build productive relationships with both internal and external stakeholders in a hybrid working environment. Required Skills & Experience Strong experience designing and executing detection and protective controls, ideally within SAP ERP systems. Experience in one of Onapsis, Security Bridge, SAP ETD, Pathlock CAC. Strong experience of implementing vulnerability management controls (implementation and testing). Knowledge of relevant industry frameworks and vendor solutions aligned to provide such control solutions. Demonstrated ability to lead engagements and communicate effectively with senior stakeholders. Proven track record in team management and mentoring. Familiarity with the consulting sales lifecycle, including opportunity identification and bid support. Excellent analytical, presentation, and organisational skills. Preferred Qualifications Professional certifications such as CREST or equivalent. Experience in risk advisory or Big Four consultancy environment. Exposure to emerging technologies in risk and controls, such as automation, data analytics, AI etc. Reports to: RSC Director Salary: Competitive salary depending on a combination of factors, including level of experience and expertise, in addition to an OTE bonus. Benefits Pension: on joining, employees will be automatically enrolled in our workplace pension scheme Holiday Entitlement: employees receive 25 days per holiday year plus all statutory bank and public holidays in England and Wales Private Medical Insurance: employees will be enrolled onto the company BUPA healthcare scheme Insurances: Life Insurance and Critical Illness cover are provided to all employees Carbon Offset: Employees will be enrolled on the company's carbon offset scheme, which is committed to offsetting at least 50% of all employees' personal carbon emissions. All Turnkey employees are entitled to £40 worth of carbon credits each year, which can offset 7 tonnes of carbon. Options are available to increase carbon credit amounts, which would be treated as a benefit in kind. Location: Based in our London office, with hybrid working (expected office working 2-3 days per week). Occasional travel to our offices in other countries will be expected as part of this role if there is a requirement to do so.
Jan 01, 2026
Full time
About Us Turnkey Consulting is an independent risk and security consultancy that brings together people, protection, and performance to help organisations achieve Digital Enterprise Resilience. For more than 20 years, Turnkey has enabled the world's leading companies to understand and optimise their risk and security landscape through assessment-based road mapping, organisational empowerment, and expert application of market-leading technologies. Turnkey is headquartered in London with offices across Asia, Australia, Europe, and North America. Role Overview We are seeking an experienced individual with a strong foundation in SAP Vulnerability Management and Threat Detection systems, including associated controls, proficiency in SAP environments, and awareness of Cybersecurity frameworks. Key Responsibilities Design, implement, and assess vulnerability management frameworks, primarily within SAP-enabled environments. Lead client conversations on SAP Vulnerability and Threat Management strategy, compliance challenges, and controls optimisation. Provide insight on Information Security frameworks (OWASP/NIST/NIS2 etc.) and the Secure Operations Map, helping communicate regulatory or good practice obligations and actionable solutions. Manage and mentor junior consultants and analysts to aid a high-performance team culture. Support business development activities, including scoping, proposal development, and client pitches throughout the sales lifecycle. Build long-term relationships with clients as a trusted advisor in controls and compliance. Required Core Behaviours Ability to focus on the "why" of our solutions, not just the how. Demonstrable experience in prioritising the client's objectives. Passionate about improving the perception of the industry towards a more business growth enabling function. Demonstrable ability to build productive relationships with both internal and external stakeholders in a hybrid working environment. Required Skills & Experience Strong experience designing and executing detection and protective controls, ideally within SAP ERP systems. Experience in one of Onapsis, Security Bridge, SAP ETD, Pathlock CAC. Strong experience of implementing vulnerability management controls (implementation and testing). Knowledge of relevant industry frameworks and vendor solutions aligned to provide such control solutions. Demonstrated ability to lead engagements and communicate effectively with senior stakeholders. Proven track record in team management and mentoring. Familiarity with the consulting sales lifecycle, including opportunity identification and bid support. Excellent analytical, presentation, and organisational skills. Preferred Qualifications Professional certifications such as CREST or equivalent. Experience in risk advisory or Big Four consultancy environment. Exposure to emerging technologies in risk and controls, such as automation, data analytics, AI etc. Reports to: RSC Director Salary: Competitive salary depending on a combination of factors, including level of experience and expertise, in addition to an OTE bonus. Benefits Pension: on joining, employees will be automatically enrolled in our workplace pension scheme Holiday Entitlement: employees receive 25 days per holiday year plus all statutory bank and public holidays in England and Wales Private Medical Insurance: employees will be enrolled onto the company BUPA healthcare scheme Insurances: Life Insurance and Critical Illness cover are provided to all employees Carbon Offset: Employees will be enrolled on the company's carbon offset scheme, which is committed to offsetting at least 50% of all employees' personal carbon emissions. All Turnkey employees are entitled to £40 worth of carbon credits each year, which can offset 7 tonnes of carbon. Options are available to increase carbon credit amounts, which would be treated as a benefit in kind. Location: Based in our London office, with hybrid working (expected office working 2-3 days per week). Occasional travel to our offices in other countries will be expected as part of this role if there is a requirement to do so.
Sr. Analyst, Information Security page is loaded Sr. Analyst, Information Securitylocations: United Kingdom, Edinburgh, SC, Freertime type: Full timeposted on: Posted Todayjob requisition id: R258363 About Analog Devices Analog Devices, Inc. (NASDAQ: ) is a global semiconductor leader that bridges the physical and digital worlds to enable breakthroughs at the Intelligent Edge. ADI combines analog, digital, and software technologies into solutions that help drive advancements in digitized factories, mobility, and digital healthcare, combat climate change, and reliably connect humans and the world. With revenue of more than $9 billion in FY24 and approximately 24,000 people globally, ADI ensures today's innovators stay Ahead of What's Possible. Learn more at and on and . Network Security Engineer Cyber Defence Job Req: Role Overview The Network Security Engineer is responsible for designing, implementing, and maintaining secure network infrastructures. This role ensures the organisation's firewalls, VPNs, and network security controls are properly configured, monitored, and compliant with industry standards. We are looking for a proactive and solution orientated professional with excellent problem-solving and analytical skills. You will want to stay current with emerging threats, technologies, and best practices and will have the ability to think strategically and act tactically. You will be the authority on keeping an Analog Devices' computer networks safe from threats and ensuring secure connectivity for critical business operations. Key Responsibilities Provide governance for the configuration, management, and optimisation firewalls, IDS/IPS, and network security appliances. Perform firewall posture management, including rule audits, cleanup, and compliance checks. Govern the implementation and maintenance of network segmentation, secure remote access, and VPN solutions. Monitor network traffic for anomalies and respond to security incidents. Develop and enforce network security policies and standards. Ensure compliance with security standards and regulations. Conduct vulnerability assessments and support patching of network devices. Automate routine tasks using scripts or security orchestration tools. Implement cloud security controls across AWS, Azure, and GCP, applying Zero Trust principles and securing hybrid network architectures for resilience Establish reporting for ADIs network security posture and help to develop plans for continuous improvement Develop and maintain detection logic leveraging network telemetry (e.g., NetFlow, DNS logs, proxy logs) to identify anomalous or malicious activity. Collaborate with SOC teams to create and update run-books for network-related incidents, ensuring consistent and efficient response workflows. Continuously improve detection coverage by analysing threat trends and incorporating new indicators into network monitoring tools Essential More than three (3) years' experience in a network security engineering role An in-depth understanding of networking protocols and technologies Demonstrable hands-on experience with security tools and platforms: Network Detection & Response, Secure Web Gateways/Proxies, Intrusion detection and prevention systems (IDS/IPS), Enterprise firewalls and SIEM platforms and vulnerability management tools Experience with cloud security for AWS, Azure, or GCP and securing cloud networking components. Familiarity with security frameworks such as NIST, ISO 27001, or CIS and operational resilience frameworks Demonstrate social and cultural flexibility by effectively collaborating with diverse teams across global regions Qualifications University in computer science, information security, or relevant field. Professional certifications or equivalent practical experience. Demonstrable competence with network security protocols and cyber testing tools. Strong understanding of common security frameworks and compliance requirements. Excellent analytical and problem-solving skills. Good oral and written skills in English to be able to successfully communicate and collaborate across our Global business. For positions requiring access to technical data, Analog Devices, Inc. may have to obtain export licensing approval from the U.S. Department of Commerce - Bureau of Industry and Security and/or the U.S. Department of State - Directorate of Defense Trade Controls. As such, applicants for this position - except US Citizens, US Permanent Residents, and protected individuals as defined by 8 U.S.C. 1324b(a)(3) - may have to go through an export licensing review process. Analog Devices is an equal opportunity employer. We foster a culture where everyone has an opportunity to succeed regardless of their race, color, religion, age, ancestry, national origin, social or ethnic origin, sex, sexual orientation, gender, gender identity, gender expression, marital status, pregnancy, parental status, disability, medical condition, genetic information, military or veteran status, union membership, and political affiliation, or any other legally protected group. Job Req Type: ExperiencedRequired Travel: Yes, 10% of the timeShift Type: 1st Shift/Days
Jan 01, 2026
Full time
Sr. Analyst, Information Security page is loaded Sr. Analyst, Information Securitylocations: United Kingdom, Edinburgh, SC, Freertime type: Full timeposted on: Posted Todayjob requisition id: R258363 About Analog Devices Analog Devices, Inc. (NASDAQ: ) is a global semiconductor leader that bridges the physical and digital worlds to enable breakthroughs at the Intelligent Edge. ADI combines analog, digital, and software technologies into solutions that help drive advancements in digitized factories, mobility, and digital healthcare, combat climate change, and reliably connect humans and the world. With revenue of more than $9 billion in FY24 and approximately 24,000 people globally, ADI ensures today's innovators stay Ahead of What's Possible. Learn more at and on and . Network Security Engineer Cyber Defence Job Req: Role Overview The Network Security Engineer is responsible for designing, implementing, and maintaining secure network infrastructures. This role ensures the organisation's firewalls, VPNs, and network security controls are properly configured, monitored, and compliant with industry standards. We are looking for a proactive and solution orientated professional with excellent problem-solving and analytical skills. You will want to stay current with emerging threats, technologies, and best practices and will have the ability to think strategically and act tactically. You will be the authority on keeping an Analog Devices' computer networks safe from threats and ensuring secure connectivity for critical business operations. Key Responsibilities Provide governance for the configuration, management, and optimisation firewalls, IDS/IPS, and network security appliances. Perform firewall posture management, including rule audits, cleanup, and compliance checks. Govern the implementation and maintenance of network segmentation, secure remote access, and VPN solutions. Monitor network traffic for anomalies and respond to security incidents. Develop and enforce network security policies and standards. Ensure compliance with security standards and regulations. Conduct vulnerability assessments and support patching of network devices. Automate routine tasks using scripts or security orchestration tools. Implement cloud security controls across AWS, Azure, and GCP, applying Zero Trust principles and securing hybrid network architectures for resilience Establish reporting for ADIs network security posture and help to develop plans for continuous improvement Develop and maintain detection logic leveraging network telemetry (e.g., NetFlow, DNS logs, proxy logs) to identify anomalous or malicious activity. Collaborate with SOC teams to create and update run-books for network-related incidents, ensuring consistent and efficient response workflows. Continuously improve detection coverage by analysing threat trends and incorporating new indicators into network monitoring tools Essential More than three (3) years' experience in a network security engineering role An in-depth understanding of networking protocols and technologies Demonstrable hands-on experience with security tools and platforms: Network Detection & Response, Secure Web Gateways/Proxies, Intrusion detection and prevention systems (IDS/IPS), Enterprise firewalls and SIEM platforms and vulnerability management tools Experience with cloud security for AWS, Azure, or GCP and securing cloud networking components. Familiarity with security frameworks such as NIST, ISO 27001, or CIS and operational resilience frameworks Demonstrate social and cultural flexibility by effectively collaborating with diverse teams across global regions Qualifications University in computer science, information security, or relevant field. Professional certifications or equivalent practical experience. Demonstrable competence with network security protocols and cyber testing tools. Strong understanding of common security frameworks and compliance requirements. Excellent analytical and problem-solving skills. Good oral and written skills in English to be able to successfully communicate and collaborate across our Global business. For positions requiring access to technical data, Analog Devices, Inc. may have to obtain export licensing approval from the U.S. Department of Commerce - Bureau of Industry and Security and/or the U.S. Department of State - Directorate of Defense Trade Controls. As such, applicants for this position - except US Citizens, US Permanent Residents, and protected individuals as defined by 8 U.S.C. 1324b(a)(3) - may have to go through an export licensing review process. Analog Devices is an equal opportunity employer. We foster a culture where everyone has an opportunity to succeed regardless of their race, color, religion, age, ancestry, national origin, social or ethnic origin, sex, sexual orientation, gender, gender identity, gender expression, marital status, pregnancy, parental status, disability, medical condition, genetic information, military or veteran status, union membership, and political affiliation, or any other legally protected group. Job Req Type: ExperiencedRequired Travel: Yes, 10% of the timeShift Type: 1st Shift/Days
Lead Detection and Response Analyst page is loaded Lead Detection and Response Analystlocations: Farringdon, London, United Kingdomtime type: Full timeposted on: Posted Todayjob requisition id: JR-82178Job Summary:Live Nation Entertainment is the world's leading live entertainment and eCommerce company, comprised of four market leaders: Live Nation Concerts, Front Line Management Group and Live Nation Network. is the global event ticketing leader and one of the world's top five eCommerce sites, with over 26 million monthly unique visitors. Live Nation Concerts produces over 20,000 shows annually for more than 2,000 artists globally. Front Line is the world's top artist management company, representing over 250 artists. These businesses power Live Nation Network, the leading provider of entertainment marketing solutions, enabling over 800 advertisers to tap into the 200 million consumers Live Nation delivers annually through its live event and digital platforms. For additional information, visit .Passionate and motivated. Driven, with an entrepreneurial spirit. Resourceful, innovative, forward thinking and committed. At Live Nation Entertainment, our people embrace these qualities, so if this sounds like you then please read on!As a UK/EMEA Lead DART Analyst, you will serve as the bridge between frontline analysts and DART management, helping guide real-time incident response, providing mentorship and quality assurance across shifts, and contributing to process development and strategic improvement. You will lead shift operations, act as an escalation point for complex investigations, and ensure consistent application of incident response processes across global teams. Key Responsibilities Operational Leadership Coordinate daily DART shift activities to ensure smooth operations and adequate coverage. Act as an escalation point for high-priority security alerts and investigations. Act as an Incident Commander to ensure the incident investigation process is streamlined and completed from start to finish. Conduct QA reviews on tickets to ensure accuracy, completeness, and adherence to IR procedures. Lead shift handovers, ensuring continuity and communication across regions. Incident Response Monitor and triage security alerts using SIEM, EDR, and NDR platforms. Perform in-depth investigations into potential threats, applying TTP-based analysis and leveraging internal tools. Collaborate with business units and technical teams during incident response to gather context and execute containment or remediation. Provide structured documentation and recommendations post-incident. Team Support & Development Mentor junior and mid-level analysts during investigations and incident response. Support onboarding and continuous training through documentation, coaching, and hands-on guidance. Promote a culture of collaboration, accountability, and continuous improvement across shifts. Process & Tooling Contribution Help identify tooling or workflow gaps; provide recommendations to the Defense and Response Team/Detection and Response Enginnering Manager for improvements. Contribute to the creation and refinement of playbooks and operational procedures. Participate in tuning detection content and use-case development in partnership with threat detection teams. Reporting & Metrics Assist in tracking key performance indicators (Time to Detect, Time to Resolve, Escalation Ratios, etc.). Support reporting functions by summarizing incidents and shift activities in alignment with team OKRs. Required Qualifications Bachelor's degree (or higher) in Cybersecurity, Information Security, Computer Science, Information Technology, or a related field and/or 5+ years of experience in a cybersecurity analyst role, with at least 2 years in a lead or senior-level capacity . Proven hands-on experience with SIEM, EDR, NDR, and DFIR toolsets. In-depth understanding of attacker TTPs (MITRE ATT&CK) and strong investigative mindset. Experience responding to incidents in cloud environments (AWS, Azure, GCP). Excellent written and verbal communication skills, especially in cross-functional and high-pressure scenarios. Ability to guide and inspire analysts of varying experience levels. Equal OpportunitiesWe are passionate and committed to our people and go beyond the rhetoric of diversity and inclusion. You will be working in an inclusive environment and be encouraged to bring your whole self to work. We will do all that we can to help you successfully balance your work and homelife. As a growing business we will encourage you to develop your professional and personal aspirations, enjoy new experiences, and learn from the talented people you will be working with. It's talent that matters to us and we encourage applications from people irrespective of their gender identity, race, sexual orientation, religion, age, disability status or caring responsibilities. Recognized for seven years as a Great Place to Work and named one of Fortune's World's Most Admired Companies, Live Nation Entertainment is the world's leading live entertainment company comprised of global market leaders: Ticketmaster, Live Nation Concerts, and Live Nation Media & Sponsorship. Our world-class teams specialize in all aspects of the live entertainment industry, from ground-breaking innovations in ticketing, global venue development and operations, concert promotion and production, sales and brand partnerships, and unparalleled artist management supported by professionals in all facets of corporate operations. We believe in taking care of the countless employees helping artists bring live music to fans all around the world. Our many unique benefit programs are designed to help our teams live life to the fullest including generous vacation, healthcare, retirement benefits, student loan repayment, tuition reimbursement, six months of paid caregiver leave for new parents including fostering and perks like Roadie Babies helping new parents care for their babies on work trips. And of course, access to free live events through our exclusive employee ticketing program. There is no bigger stage for your career. See what your future looks like at Live Nation Entertainment.
Jan 01, 2026
Full time
Lead Detection and Response Analyst page is loaded Lead Detection and Response Analystlocations: Farringdon, London, United Kingdomtime type: Full timeposted on: Posted Todayjob requisition id: JR-82178Job Summary:Live Nation Entertainment is the world's leading live entertainment and eCommerce company, comprised of four market leaders: Live Nation Concerts, Front Line Management Group and Live Nation Network. is the global event ticketing leader and one of the world's top five eCommerce sites, with over 26 million monthly unique visitors. Live Nation Concerts produces over 20,000 shows annually for more than 2,000 artists globally. Front Line is the world's top artist management company, representing over 250 artists. These businesses power Live Nation Network, the leading provider of entertainment marketing solutions, enabling over 800 advertisers to tap into the 200 million consumers Live Nation delivers annually through its live event and digital platforms. For additional information, visit .Passionate and motivated. Driven, with an entrepreneurial spirit. Resourceful, innovative, forward thinking and committed. At Live Nation Entertainment, our people embrace these qualities, so if this sounds like you then please read on!As a UK/EMEA Lead DART Analyst, you will serve as the bridge between frontline analysts and DART management, helping guide real-time incident response, providing mentorship and quality assurance across shifts, and contributing to process development and strategic improvement. You will lead shift operations, act as an escalation point for complex investigations, and ensure consistent application of incident response processes across global teams. Key Responsibilities Operational Leadership Coordinate daily DART shift activities to ensure smooth operations and adequate coverage. Act as an escalation point for high-priority security alerts and investigations. Act as an Incident Commander to ensure the incident investigation process is streamlined and completed from start to finish. Conduct QA reviews on tickets to ensure accuracy, completeness, and adherence to IR procedures. Lead shift handovers, ensuring continuity and communication across regions. Incident Response Monitor and triage security alerts using SIEM, EDR, and NDR platforms. Perform in-depth investigations into potential threats, applying TTP-based analysis and leveraging internal tools. Collaborate with business units and technical teams during incident response to gather context and execute containment or remediation. Provide structured documentation and recommendations post-incident. Team Support & Development Mentor junior and mid-level analysts during investigations and incident response. Support onboarding and continuous training through documentation, coaching, and hands-on guidance. Promote a culture of collaboration, accountability, and continuous improvement across shifts. Process & Tooling Contribution Help identify tooling or workflow gaps; provide recommendations to the Defense and Response Team/Detection and Response Enginnering Manager for improvements. Contribute to the creation and refinement of playbooks and operational procedures. Participate in tuning detection content and use-case development in partnership with threat detection teams. Reporting & Metrics Assist in tracking key performance indicators (Time to Detect, Time to Resolve, Escalation Ratios, etc.). Support reporting functions by summarizing incidents and shift activities in alignment with team OKRs. Required Qualifications Bachelor's degree (or higher) in Cybersecurity, Information Security, Computer Science, Information Technology, or a related field and/or 5+ years of experience in a cybersecurity analyst role, with at least 2 years in a lead or senior-level capacity . Proven hands-on experience with SIEM, EDR, NDR, and DFIR toolsets. In-depth understanding of attacker TTPs (MITRE ATT&CK) and strong investigative mindset. Experience responding to incidents in cloud environments (AWS, Azure, GCP). Excellent written and verbal communication skills, especially in cross-functional and high-pressure scenarios. Ability to guide and inspire analysts of varying experience levels. Equal OpportunitiesWe are passionate and committed to our people and go beyond the rhetoric of diversity and inclusion. You will be working in an inclusive environment and be encouraged to bring your whole self to work. We will do all that we can to help you successfully balance your work and homelife. As a growing business we will encourage you to develop your professional and personal aspirations, enjoy new experiences, and learn from the talented people you will be working with. It's talent that matters to us and we encourage applications from people irrespective of their gender identity, race, sexual orientation, religion, age, disability status or caring responsibilities. Recognized for seven years as a Great Place to Work and named one of Fortune's World's Most Admired Companies, Live Nation Entertainment is the world's leading live entertainment company comprised of global market leaders: Ticketmaster, Live Nation Concerts, and Live Nation Media & Sponsorship. Our world-class teams specialize in all aspects of the live entertainment industry, from ground-breaking innovations in ticketing, global venue development and operations, concert promotion and production, sales and brand partnerships, and unparalleled artist management supported by professionals in all facets of corporate operations. We believe in taking care of the countless employees helping artists bring live music to fans all around the world. Our many unique benefit programs are designed to help our teams live life to the fullest including generous vacation, healthcare, retirement benefits, student loan repayment, tuition reimbursement, six months of paid caregiver leave for new parents including fostering and perks like Roadie Babies helping new parents care for their babies on work trips. And of course, access to free live events through our exclusive employee ticketing program. There is no bigger stage for your career. See what your future looks like at Live Nation Entertainment.
Unily partners with the world's largest and most complex enterprises to power Organizational Velocity through digital Employee Experience transformation. Iconic brands, including Estée Lauder Companies, CVS Health, and British Airways, use Unily's market-leading Employee Experience platform to improve productivity, streamline communication, and foster a highly connected workplace. Unily is the only triple leader recognized by all three of the major analysts. Unily is recognized as a Leader in the 2024 GartnerMagic Quadrantfor Intranet Packaged Solutions, the 2024 Forrester Wave: Intranet Platforms, and the IDC MarketScape: Worldwide Experience-Centric Intelligent Digital Workspaces 2024. With these accolades, we continue to grow and expand our employee community with people who are passionate about joining us on this exciting journey. Job Purpose As we continue to expand our market share in the rapidly emerging Employee Experience platform category, we are looking for an Application Security Manager. This role is responsible for building and executing a comprehensive application security programme that combines strategic oversight with hands-on technical execution. The Application Security Manager ensures that security is embedded throughout the software development lifecycle (SDLC), enabling Unily to deliver secure products at speed. The Application Security Manager will define and enforce secure development policies and practices, establish privacy by design principles, and mange the risk and escalation process. They will actively engage in technical assurance activities such as threat modelling, application testing, dependency analysis, cloud and container security assessments and CI/CD pipeline hardening. The role will act as both a strategic partner to leadership and a trusted advisor to engineering teams, being a customer facing point of contact when required. Main Responsibilities Define and maintain secure development policies and privacy by design requirements Own the risk acceptance and escalation process, maintaining the risk register Develop and measure the application security strategy levering frameworks such as OWASP SAMM Support RFPs and sales responses on application security matters Lead and coordinate external penetration testing engagements and remediation follow up Drive risk-based prioritisation, assigning and validating CVSS scores Deliver and manager secure development training programs Conduct and facilitate threat modelling and architecture and design security reviews Perform or coordinate application security testing Generate and manage software bills of materials (SBOMs) to manage supply chain risks Ensure build verification and oversee IaC and container/Kubernetes scanning within pipelines Provide guidance on secure cloud-native architectures Evaluate and apply security testing tools and techniques (e.g. Burpsuite, fuzzing, IaC scanners, Static Analysers) Contribute to security metrics, reports and dashboards Collaborate with engineering, operations and product teams to embed security best practices throughout the whole SDLC Requirements Proven experience in application security Strong knowledge of secure software development practices, DevSecOps and CI/CD security integration Hands on experience with application security testing tools and techniques (e.g. SAST, DAST, Dependency checkers, IaC scanners, secret detection, container security tools) Understanding of threat modelling, architecture and design reviews and offensive security principles Familiarity with compliance and regulatory frameworks Experience with risk acceptance processes, CVSS scoring and vulnerability management Experience managing external penetration testing vendors Familiarity with SBOMs and software supply chain security Strong background in cloud and container security Ability to communicate with technical and non-technical stakeholders Knowledge of data privacy regulations and GDPR, and how they intersect with application security Certifications such as CISSP, CSSLP, OSWE, OSCP or equivalents Degree in computer science, cyber security, related fields or equivalent experience We are united by a shared purpose and are committed to truly understanding each other. We know that everyone is unique and has their own story. We strive to have a diverse workforce that embraces and celebrates one another. We are united in building connections and curious to learn from each other so that we continue to grow together to build the workplace of tomorrow. Why Work For Unily? In addition to a generous base salary and discretionary company bonus, here are some things we think you will love: Our awesome team culture. We are focused on achieving results as a team and having fun while we do it. You won't find a friendlier or more dedicated bunch of people. Our industry leading product. We are very proud of our ever-evolving product, naturally we use (and love) it internally and provide the tools and resources for you (and our clients) to become a Unily expert. The flexibility that we offer. We don't just mean working from home occasionally. We operate on a hybrid basis, and also recognize that life happens during the 9-5.30 and encourage a sustainable work/life balance. Our bright and modern office spaces. When you need to be in the office we want it to be like being at home. We have a well-stocked kitchen and the option to bring your dog to work. We offer a fantastic suite of benefits. Including 25 days holiday plus an extra paid day off to enjoy your birthday, Vitality life cover (for health, sight, hearing and dental), Aviva pension (via a salary sacrifice scheme), life assurance, income protection and so many more. Our commitment to sustainability and giving back to the community.We know working for an organisation that takes its environmental & social impact seriously is important, and we are proud to offer 1 fully paid volunteering day per year, an employee matching charity donation scheme and options to lease an Electric Vehicle through our salary sacrifice scheme. View Unily's UK & EEA Careers Privacy Notice here View Unily's USA Careers Privacy Notice here
Jan 01, 2026
Full time
Unily partners with the world's largest and most complex enterprises to power Organizational Velocity through digital Employee Experience transformation. Iconic brands, including Estée Lauder Companies, CVS Health, and British Airways, use Unily's market-leading Employee Experience platform to improve productivity, streamline communication, and foster a highly connected workplace. Unily is the only triple leader recognized by all three of the major analysts. Unily is recognized as a Leader in the 2024 GartnerMagic Quadrantfor Intranet Packaged Solutions, the 2024 Forrester Wave: Intranet Platforms, and the IDC MarketScape: Worldwide Experience-Centric Intelligent Digital Workspaces 2024. With these accolades, we continue to grow and expand our employee community with people who are passionate about joining us on this exciting journey. Job Purpose As we continue to expand our market share in the rapidly emerging Employee Experience platform category, we are looking for an Application Security Manager. This role is responsible for building and executing a comprehensive application security programme that combines strategic oversight with hands-on technical execution. The Application Security Manager ensures that security is embedded throughout the software development lifecycle (SDLC), enabling Unily to deliver secure products at speed. The Application Security Manager will define and enforce secure development policies and practices, establish privacy by design principles, and mange the risk and escalation process. They will actively engage in technical assurance activities such as threat modelling, application testing, dependency analysis, cloud and container security assessments and CI/CD pipeline hardening. The role will act as both a strategic partner to leadership and a trusted advisor to engineering teams, being a customer facing point of contact when required. Main Responsibilities Define and maintain secure development policies and privacy by design requirements Own the risk acceptance and escalation process, maintaining the risk register Develop and measure the application security strategy levering frameworks such as OWASP SAMM Support RFPs and sales responses on application security matters Lead and coordinate external penetration testing engagements and remediation follow up Drive risk-based prioritisation, assigning and validating CVSS scores Deliver and manager secure development training programs Conduct and facilitate threat modelling and architecture and design security reviews Perform or coordinate application security testing Generate and manage software bills of materials (SBOMs) to manage supply chain risks Ensure build verification and oversee IaC and container/Kubernetes scanning within pipelines Provide guidance on secure cloud-native architectures Evaluate and apply security testing tools and techniques (e.g. Burpsuite, fuzzing, IaC scanners, Static Analysers) Contribute to security metrics, reports and dashboards Collaborate with engineering, operations and product teams to embed security best practices throughout the whole SDLC Requirements Proven experience in application security Strong knowledge of secure software development practices, DevSecOps and CI/CD security integration Hands on experience with application security testing tools and techniques (e.g. SAST, DAST, Dependency checkers, IaC scanners, secret detection, container security tools) Understanding of threat modelling, architecture and design reviews and offensive security principles Familiarity with compliance and regulatory frameworks Experience with risk acceptance processes, CVSS scoring and vulnerability management Experience managing external penetration testing vendors Familiarity with SBOMs and software supply chain security Strong background in cloud and container security Ability to communicate with technical and non-technical stakeholders Knowledge of data privacy regulations and GDPR, and how they intersect with application security Certifications such as CISSP, CSSLP, OSWE, OSCP or equivalents Degree in computer science, cyber security, related fields or equivalent experience We are united by a shared purpose and are committed to truly understanding each other. We know that everyone is unique and has their own story. We strive to have a diverse workforce that embraces and celebrates one another. We are united in building connections and curious to learn from each other so that we continue to grow together to build the workplace of tomorrow. Why Work For Unily? In addition to a generous base salary and discretionary company bonus, here are some things we think you will love: Our awesome team culture. We are focused on achieving results as a team and having fun while we do it. You won't find a friendlier or more dedicated bunch of people. Our industry leading product. We are very proud of our ever-evolving product, naturally we use (and love) it internally and provide the tools and resources for you (and our clients) to become a Unily expert. The flexibility that we offer. We don't just mean working from home occasionally. We operate on a hybrid basis, and also recognize that life happens during the 9-5.30 and encourage a sustainable work/life balance. Our bright and modern office spaces. When you need to be in the office we want it to be like being at home. We have a well-stocked kitchen and the option to bring your dog to work. We offer a fantastic suite of benefits. Including 25 days holiday plus an extra paid day off to enjoy your birthday, Vitality life cover (for health, sight, hearing and dental), Aviva pension (via a salary sacrifice scheme), life assurance, income protection and so many more. Our commitment to sustainability and giving back to the community.We know working for an organisation that takes its environmental & social impact seriously is important, and we are proud to offer 1 fully paid volunteering day per year, an employee matching charity donation scheme and options to lease an Electric Vehicle through our salary sacrifice scheme. View Unily's UK & EEA Careers Privacy Notice here View Unily's USA Careers Privacy Notice here
Principal Cyber Security Incident Response Analyst 60,000 - 70,000 Full Time / Permanent West Midlands / Hybrid (1-2 days a month in the office ideally) The Role I am looking for a driven and experienced Principal Cyber Security Incident Response Analyst to join a large nationally recognised brand head quartered in the West Midlands. As a Principal Cyber Security Incident Response Analyst, you will play a pivotal role in protecting critical systems, assets, and people from cyber security threats. You'll be part of a world-class team, working at the forefront of threat detection and response. We are ideally looking for someone Midlands based who can be on site in Warwickshire 1-2 days a month on average. Responsibilities Provide leadership and mentorship to Analysts and Senior Analysts, fostering a culture of excellence and continuous development. Drive the evolution and enhancement of the Cyber Security Incident Response function, ensuring the team consistently meets and exceeds key performance indicators. Lead investigations and remediation efforts for cyber security incidents and alerts across diverse sources, including network, endpoint, cloud environments, and threat intelligence feeds. Perform in-depth trend analysis to identify patterns and inform improvements in organisational controls and threat detection capabilities. Develop, maintain, and continuously improve documentation and reporting frameworks to support transparency, consistency, and strategic decision-making. Experience required: Previous experience in a similar Cyber Incident Response Analyst role, preferably in a senior or lead capacity. Strong experience in security monitoring across diverse systems and environments, including cloud and on-premises. Proven leadership in incident response within SOC settings. Deep understanding of the cyber threat landscape, attack vectors, and detection techniques. Proficient in cybersecurity tools, regulations, and compliance standards. Excellent communication and stakeholder engagement skills, with the ability to convey technical insights to varied audiences. Please apply via the link or contact (url removed) for more information Modis International Ltd acts as an employment agency for permanent recruitment and an employment business for the supply of temporary workers in the UK. Modis Europe Ltd provide a variety of international solutions that connect clients to the best talent in the world. For all positions based in Switzerland, Modis Europe Ltd works with its licensed Swiss partner Accurity GmbH to ensure that candidate applications are handled in accordance with Swiss law. Both Modis International Ltd and Modis Europe Ltd are Equal Opportunities Employers. By applying for this role your details will be submitted to Modis International Ltd and/ or Modis Europe Ltd. Our Candidate Privacy Information Statement which explains how we will use your information is available on the Modis website.
Jan 01, 2026
Full time
Principal Cyber Security Incident Response Analyst 60,000 - 70,000 Full Time / Permanent West Midlands / Hybrid (1-2 days a month in the office ideally) The Role I am looking for a driven and experienced Principal Cyber Security Incident Response Analyst to join a large nationally recognised brand head quartered in the West Midlands. As a Principal Cyber Security Incident Response Analyst, you will play a pivotal role in protecting critical systems, assets, and people from cyber security threats. You'll be part of a world-class team, working at the forefront of threat detection and response. We are ideally looking for someone Midlands based who can be on site in Warwickshire 1-2 days a month on average. Responsibilities Provide leadership and mentorship to Analysts and Senior Analysts, fostering a culture of excellence and continuous development. Drive the evolution and enhancement of the Cyber Security Incident Response function, ensuring the team consistently meets and exceeds key performance indicators. Lead investigations and remediation efforts for cyber security incidents and alerts across diverse sources, including network, endpoint, cloud environments, and threat intelligence feeds. Perform in-depth trend analysis to identify patterns and inform improvements in organisational controls and threat detection capabilities. Develop, maintain, and continuously improve documentation and reporting frameworks to support transparency, consistency, and strategic decision-making. Experience required: Previous experience in a similar Cyber Incident Response Analyst role, preferably in a senior or lead capacity. Strong experience in security monitoring across diverse systems and environments, including cloud and on-premises. Proven leadership in incident response within SOC settings. Deep understanding of the cyber threat landscape, attack vectors, and detection techniques. Proficient in cybersecurity tools, regulations, and compliance standards. Excellent communication and stakeholder engagement skills, with the ability to convey technical insights to varied audiences. Please apply via the link or contact (url removed) for more information Modis International Ltd acts as an employment agency for permanent recruitment and an employment business for the supply of temporary workers in the UK. Modis Europe Ltd provide a variety of international solutions that connect clients to the best talent in the world. For all positions based in Switzerland, Modis Europe Ltd works with its licensed Swiss partner Accurity GmbH to ensure that candidate applications are handled in accordance with Swiss law. Both Modis International Ltd and Modis Europe Ltd are Equal Opportunities Employers. By applying for this role your details will be submitted to Modis International Ltd and/ or Modis Europe Ltd. Our Candidate Privacy Information Statement which explains how we will use your information is available on the Modis website.
Location(s): UK, Europe & Africa: UK: London UK, Europe & Africa: UK: Leeds BAE Systems Digital Intelligence is home to 4,500 digital, cyber and intelligence experts. We work collaboratively across 10 countries to collect, connect and understand complex data, so that governments, nation states, armed forces and commercial businesses can unlock digital advantage in the most demanding environments. We offer a range of hybrid and flexible working arrangements - please speak to your recruiter about the options for this particular role. Grade: GG11 Referral Bonus: £5,000 SOC Engineering Lead Role description BAE Systems are bidding to undertake the day to day operation of (and incremental improvement of) a dedicated Security Operations Centre (SOC) to support the defence of a major UK CNI organisation. The networks protected are predominantly hosted in Azure cloud platforms, with many systems within these environments that must be protected. The customer is committed to development of this improved SOC to be a benchmark of best practice and excellence in reflection of the significant threat that the protected systems are subject to. The SOC will be staffed by a blend of customer and BAE Systems staff, based in multiple locations, but with the day to day operations both remotely and in the customer's premises. These roles require a minimum of SC clearance. Due to timelines for the start of operations, it will not be possible to sponsor new clearances so candidates must have existing clearances. The SOC Engineering lead is responsible for planning and managing development, testing and implementation activities for both day to day activities - delivering new / updated rules and analytics for the Azure SIEM and SOAR platforms, and production of playbooks leading the Analytics and Rules (A&R) Teams prioritising and coordinating their activities across the various projects / releases - as well as long term improvement upgrades and activities. The day-to-day focus of the Engineering team which you will manage day to day is working with the Protective Monitoring, Threat Intelligence and wider SOC operations Teams to scope and define the requirements for tuning existing security use cases and creating new detection content. This includes planning each release and overseeing all design, development, testing and implementation activities. The strategic focus of the Engineering Lead is to ensure that the detection and monitoring technology remains optimised, current and tailored to the changing threat landscape, authority risk position and technology in use. The SOC Engineering Lead is an IT and cyber technical specialist with deep knowledge of the Cyber Monitoring technologies and cyber threat tools, tactics, techniques and procedures and demonstrable experience of prior SOC Engineering roles of a similar nature, with clear understanding of how engineering impacts the people and process aspects of a SOC. Responsibilities You will help grow and evolve the customer SOC capability by documenting the platforms, feeding back lessons learned and working with the wider team in establishing best practices and repeatable engineering processes. You will feed back requirements that you have captured during the project continually to appropriate customer and BAE Systems management teams to help to steer the SOC roadmap. You will work with technical project managers, engineers, solution architects, as well as the end-customer senior stakeholders. Given the CNI client focus of this role, flexibility in our designs and delivery methodologies is essential to ensure timely and potentially safety complaint delivery to the customer's satisfaction. Oversee deployment / implementation activities ensuring that entry criteria are met, all planned activities are completed and that rollback plans are initiated where required. Develop, test and deploy updated and new content across the monitored estate in liaison with the Operations teams. Take playbooks from the wider SOC teams, develop technical aspects, seek approval, and deploy - sometimes directly and sometimes as an mentor to the team. Accountable for the maintenance of existing detection content to ensure it remains current and relevant to the monitored estate. Assess the effectiveness of new / updated rules and analytics to feed into future development activities. Review and approve all required documentation as part of a release or change including design, deployment, configuration and administration guides. Oversee and remain responsible for the maintenance of underlying Azure and off-Azure infrastructure related to the SOC. Obtain authorisation for implementing releases and changes through the Change Management process for ICT and SOC component changes. Requirements Technical Strong knowledge of how Azure security functions work as security controls as well as detection tools to protect large cloud estates; Produce content and playbooks on Sentinal to detect security breaches and recognise the importance of threat led Use Cases. Knowledge of SIEM/SOAR tools (Sentinel at a minimum) and other appropriate tooling e.g. SOAR, Threat Intelligence, traffic analysis tools etc. to identify signs of an intrusion, and advise where new/improved tooling could enhance the SOC operation Deep knowledge and experience of operational ICT service delivery management. Working with a range of security tooling/technology Strong understanding of security architecture, in particular networking Detailed understanding of threat intelligence and threat actors, TTPs and operationalising threat intelligence. Understand TCP/IP component layers to identify normal and abnormal traffic Experience of undertaking SOC Analyst activities would be beneficial Experience developing wider SIEM/SOAR content highly desirable Non-technical Client side consulting, including stakeholder engagement and the ability to communicate insights and concepts to others (including briefing skills and report writing) Team Leadership Coaching mindset - help and mentor team Security process development Able to understand and adapt to different cultures and hierarchical structures. Self-starter and capable of independent working Team player and adept at working in multi-disciplinary and diverse teams Why BAE Systems? This is a place where you'll be able to make a real difference. You'll be part of an inclusive culture that values diversity, rewards integrity, and merit, and where you'll be empowered to fulfil your potential. We welcome candidates from all backgrounds and particularly from sections of the community who are currently underrepresented within our industry, including women, ethnic minorities, people with disabilities and LGBTQ+ individuals. We also want to make sure that our recruitment processes are as inclusive as possible. If you have a disability or health condition (for example dyslexia, autism, an anxiety disorder etc.) that may affect your performance in certain assessment types, please speak to your recruiter about potential reasonable adjustments. PLEASE NOTE You're expected to have completed 12 months in role prior to applying for an advertised vacancy and you should also discuss the internal opportunity with your line manager to ensure sustained business continuity and to further support your career development. We know there may be individual circumstances that impact this, so please discuss this with your line manager or HR Business Partner (HRBP). If you don't feel you can talk to your line manager, you can contact your HRBP. Should you be invited for interview, you will be giving consent for the Recruitment team to contact you and your line manager regarding your application for this opportunity. This vacancy is eligible for the UK Employee Referral Scheme. Amount: £5000 Life at BAE Systems Digital Intelligence We are embracing Hybrid Working. This means you and your colleagues may be working in different locations, such as from home, another BAE Systems office or client site, some or all of the time, and work might be going on at different times of the day. By embracing technology, we can interact, collaborate and create together, even when we're working remotely from one another. Hybrid Working allows for increased flexibility in when and where we work, helping us to balance our work and personal life more effectively, and enhance well-being. Diversity and inclusion are integral to the success of BAE Systems Digital Intelligence. We are proud to have an organisational culture where employees with varying perspectives, skills, life experiences and backgrounds - the best and brightest minds - can work together to achieve excellence and realise individual and organisational potential. Division overview: Government At BAE Systems Digital Intelligence, we pride ourselves in being a leader in the cyber defence industry, and Government contracts are an area we have many decades of experience in. Government and key infrastructure networks are critical targets to defend as the effects of these networks being breached can be devastating. As a member of the Government business unit, you will defend the connected world and ensure the protection of nations. We all have a role to play in defending our clients, and this is yours.
Jan 01, 2026
Full time
Location(s): UK, Europe & Africa: UK: London UK, Europe & Africa: UK: Leeds BAE Systems Digital Intelligence is home to 4,500 digital, cyber and intelligence experts. We work collaboratively across 10 countries to collect, connect and understand complex data, so that governments, nation states, armed forces and commercial businesses can unlock digital advantage in the most demanding environments. We offer a range of hybrid and flexible working arrangements - please speak to your recruiter about the options for this particular role. Grade: GG11 Referral Bonus: £5,000 SOC Engineering Lead Role description BAE Systems are bidding to undertake the day to day operation of (and incremental improvement of) a dedicated Security Operations Centre (SOC) to support the defence of a major UK CNI organisation. The networks protected are predominantly hosted in Azure cloud platforms, with many systems within these environments that must be protected. The customer is committed to development of this improved SOC to be a benchmark of best practice and excellence in reflection of the significant threat that the protected systems are subject to. The SOC will be staffed by a blend of customer and BAE Systems staff, based in multiple locations, but with the day to day operations both remotely and in the customer's premises. These roles require a minimum of SC clearance. Due to timelines for the start of operations, it will not be possible to sponsor new clearances so candidates must have existing clearances. The SOC Engineering lead is responsible for planning and managing development, testing and implementation activities for both day to day activities - delivering new / updated rules and analytics for the Azure SIEM and SOAR platforms, and production of playbooks leading the Analytics and Rules (A&R) Teams prioritising and coordinating their activities across the various projects / releases - as well as long term improvement upgrades and activities. The day-to-day focus of the Engineering team which you will manage day to day is working with the Protective Monitoring, Threat Intelligence and wider SOC operations Teams to scope and define the requirements for tuning existing security use cases and creating new detection content. This includes planning each release and overseeing all design, development, testing and implementation activities. The strategic focus of the Engineering Lead is to ensure that the detection and monitoring technology remains optimised, current and tailored to the changing threat landscape, authority risk position and technology in use. The SOC Engineering Lead is an IT and cyber technical specialist with deep knowledge of the Cyber Monitoring technologies and cyber threat tools, tactics, techniques and procedures and demonstrable experience of prior SOC Engineering roles of a similar nature, with clear understanding of how engineering impacts the people and process aspects of a SOC. Responsibilities You will help grow and evolve the customer SOC capability by documenting the platforms, feeding back lessons learned and working with the wider team in establishing best practices and repeatable engineering processes. You will feed back requirements that you have captured during the project continually to appropriate customer and BAE Systems management teams to help to steer the SOC roadmap. You will work with technical project managers, engineers, solution architects, as well as the end-customer senior stakeholders. Given the CNI client focus of this role, flexibility in our designs and delivery methodologies is essential to ensure timely and potentially safety complaint delivery to the customer's satisfaction. Oversee deployment / implementation activities ensuring that entry criteria are met, all planned activities are completed and that rollback plans are initiated where required. Develop, test and deploy updated and new content across the monitored estate in liaison with the Operations teams. Take playbooks from the wider SOC teams, develop technical aspects, seek approval, and deploy - sometimes directly and sometimes as an mentor to the team. Accountable for the maintenance of existing detection content to ensure it remains current and relevant to the monitored estate. Assess the effectiveness of new / updated rules and analytics to feed into future development activities. Review and approve all required documentation as part of a release or change including design, deployment, configuration and administration guides. Oversee and remain responsible for the maintenance of underlying Azure and off-Azure infrastructure related to the SOC. Obtain authorisation for implementing releases and changes through the Change Management process for ICT and SOC component changes. Requirements Technical Strong knowledge of how Azure security functions work as security controls as well as detection tools to protect large cloud estates; Produce content and playbooks on Sentinal to detect security breaches and recognise the importance of threat led Use Cases. Knowledge of SIEM/SOAR tools (Sentinel at a minimum) and other appropriate tooling e.g. SOAR, Threat Intelligence, traffic analysis tools etc. to identify signs of an intrusion, and advise where new/improved tooling could enhance the SOC operation Deep knowledge and experience of operational ICT service delivery management. Working with a range of security tooling/technology Strong understanding of security architecture, in particular networking Detailed understanding of threat intelligence and threat actors, TTPs and operationalising threat intelligence. Understand TCP/IP component layers to identify normal and abnormal traffic Experience of undertaking SOC Analyst activities would be beneficial Experience developing wider SIEM/SOAR content highly desirable Non-technical Client side consulting, including stakeholder engagement and the ability to communicate insights and concepts to others (including briefing skills and report writing) Team Leadership Coaching mindset - help and mentor team Security process development Able to understand and adapt to different cultures and hierarchical structures. Self-starter and capable of independent working Team player and adept at working in multi-disciplinary and diverse teams Why BAE Systems? This is a place where you'll be able to make a real difference. You'll be part of an inclusive culture that values diversity, rewards integrity, and merit, and where you'll be empowered to fulfil your potential. We welcome candidates from all backgrounds and particularly from sections of the community who are currently underrepresented within our industry, including women, ethnic minorities, people with disabilities and LGBTQ+ individuals. We also want to make sure that our recruitment processes are as inclusive as possible. If you have a disability or health condition (for example dyslexia, autism, an anxiety disorder etc.) that may affect your performance in certain assessment types, please speak to your recruiter about potential reasonable adjustments. PLEASE NOTE You're expected to have completed 12 months in role prior to applying for an advertised vacancy and you should also discuss the internal opportunity with your line manager to ensure sustained business continuity and to further support your career development. We know there may be individual circumstances that impact this, so please discuss this with your line manager or HR Business Partner (HRBP). If you don't feel you can talk to your line manager, you can contact your HRBP. Should you be invited for interview, you will be giving consent for the Recruitment team to contact you and your line manager regarding your application for this opportunity. This vacancy is eligible for the UK Employee Referral Scheme. Amount: £5000 Life at BAE Systems Digital Intelligence We are embracing Hybrid Working. This means you and your colleagues may be working in different locations, such as from home, another BAE Systems office or client site, some or all of the time, and work might be going on at different times of the day. By embracing technology, we can interact, collaborate and create together, even when we're working remotely from one another. Hybrid Working allows for increased flexibility in when and where we work, helping us to balance our work and personal life more effectively, and enhance well-being. Diversity and inclusion are integral to the success of BAE Systems Digital Intelligence. We are proud to have an organisational culture where employees with varying perspectives, skills, life experiences and backgrounds - the best and brightest minds - can work together to achieve excellence and realise individual and organisational potential. Division overview: Government At BAE Systems Digital Intelligence, we pride ourselves in being a leader in the cyber defence industry, and Government contracts are an area we have many decades of experience in. Government and key infrastructure networks are critical targets to defend as the effects of these networks being breached can be devastating. As a member of the Government business unit, you will defend the connected world and ensure the protection of nations. We all have a role to play in defending our clients, and this is yours.
