24 x 7 Security Analyst

Role Purpose

Working as a key member of our SOC 24x7 shift team, you will use your expertise to detect and respond to a multitude of threats of differing capability and sophistication. You will use SIEM, EDR, Network Monitoring, bespoke tooling and Threat Intelligence solutions to triage suspicious events, provide context and an assessment of risk/threat to customers to enable efficient response and continuously monitor customer environments; yet it doesn’t stop there.    

Not only will you be expected to assess threats using all information sources available to you, but you’ll also get involved in projects that enhance the capability of our services and ensure we are providing cutting-edge detection & response services to our clients. This includes threat hunting, supporting the implementation of new cutting-edge technology, malware analysis, recommending detections and getting involved in strategic cross-team projects as part of your wider role within our award-winning Security Operations Centre. 

We’re a high-trust, close-knit team that doesn’t operate under the traditional SOC tiers, so the passion and drive to get involved, make a difference and use your eye for detail to spot patterns and support both our security mission and that of our customers is essential. 

Key Role Responsibilities

The following list is indicative of the overall expectations of the role (not exhaustive): 

• Operate as part of the 24x7 SOC Monitor Team, providing proactive defensive monitoring to clients of all shapes, sizes and industries.

• Generate detailed, informative, and actionable incident reports from your investigations with applicable recommendations, mitigations, and remediations.

• Respond to, and action all alerts and customer requests within agreed SLAs.

• Maintain an awareness of the latest Defensive Monitoring technologies and trends.

• Maintain an up-to-date understanding of current threats and trends in cyber crime.

• Produce high quality management and operational reports within agreed SLAs.

• Constantly strive to tune and improve alerts, playbooks, and automations.

• Maintain regular written and verbal communication with customers, suppliers, and internally as required.

Technical/Professional/Qualifications/Requirements

The following list of requirements are pre-requisites for the role: 

• Experience with Microsoft Sentinel and Microsoft Defender (Defender for Endpoint, Defender for Identity, Defender for Cloud Apps), including deployment, configuration, and day-to-day operational management within an enterprise environment.

• Knowledge of SIEM and EDR/EPP technologies, with a particular focus on leveraging Microsoft Sentinel and Defender to deliver threat detection, investigation, and response capabilities.

• Proven ability to operate within a complex, high-performing service management enterprise environment, using Microsoft’s security tools to enhance visibility, resilience, and incident response effectiveness.

• Experience in conducting security investigations using large datasets, with knowledge of Kusto Query Language (KQL) to develop custom Sentinel queries and analytics rules.

• Solid understanding of enterprise IT infrastructure, including Windows and Linux operating systems, networking, and third-party security tools — and how these integrate with the Microsoft security ecosystem.

• Experience of analysing complex security data within Sentinel and Defender portals, identifying patterns, prioritising threats, and presenting actionable recommendations.

• An understanding of attack vectors, MITRE ATT&CK framework, and adversary behaviours, with the ability to distinguish between normal and abnormal activity.

• Excellent communication skills, with experience in customer-facing roles and the ability to clearly convey technical findings and security risk to both technical and non-technical stakeholders, using Microsoft dashboards and reporting tools.

Desirable:

• Microsoft certifications such as SC-200 and SC-100

• Crowdstrike certifications such as CCFA

• Python, PowerShell, and RegEx skills

Key Performance Indicators

Key Performance Indicators (KPIs) are goals that must be achieved in order to demonstrate satisfactory or above performance for this job role.  KPIs will be monitored on an on-going basis throughout each year and will be explored in further depth as part of the performance management process.

• Triage and action all security alerts and customer requests within established SLAs

• Maintain documentation of processes, investigations, and use-cases

• Complete all management reporting, projects, and any other assigned work

• Develop the Security Engineering technology stack through upgrades and automation.

• Mentor junior members of staff and develop their technical understanding.

• Adhere to Analyst Best Practice, Core Competencies, Compliance and Process/Procedure Standards

• Adhere to LRQA Policies and Procedures, as detailed in the HR ‘UK Employee Handbook’ and ‘Policies & Procedures’ sections of the LRQA Intranet