Incident Response Analyst

What you'll do

• Act as the L3 escalation point for incidents raised by L1/L2 analysts.
• Lead investigation, containment, eradication and recovery for security incidents.
• Carry out deep-dive analysis across SIEM, EDR, network and log data.
• Perform threat hunting and root cause analysis, and recommend remediation.
• Write clear incident reports and brief stakeholders and management.
• Improve detection rules, playbooks and SOC processes.
• Mentor and support L1/L2 analysts.

What you'll need

• Significant SOC experience, including time at L3 or senior incident response level.
• Hands-on experience with SIEM and EDR tooling [e.g. Splunk, Sentinel, CrowdStrike, Defender].
• Strong knowledge of attack techniques and frameworks such as MITRE ATT&CK.
• Experience handling incidents end to end in an enterprise environment.
• Financial services experience is a strong advantage.
• Able to start ASAP and work 3 days a week on site in London.