Cyber Defence SecOps Analyst

We are seeking a skilled Cyber Defence SecOps Analyst to join our global security team. The ideal candidate will have solid experience in security operations, vulnerability management, incident response, and threat hunting. This role involves supporting vulnerability assessment and remediation efforts, investigating security incidents, managing asset and scan coverage, and maintaining security tooling across a large enterprise environment. The successful candidate will demonstrate hands-on expertise with enterprise security tools, risk-based vulnerability prioritization, and security automation. Flexibility to handle multiple workstreams and participate in a shared 24/7 on-call rotation is essential.

Key Responsibilities

- Analyze and prioritize vulnerabilities from various sources, including Tenable, Microsoft Defender, CrowdStrike Falcon, Darktrace, GitHub Advanced Security, and application security testing tools.
- Track vulnerabilities from identification through to closure, coordinating remediation with infrastructure, cloud, application, and platform teams, and validating remediation evidence.
- Prioritize exposures based on exploitability, CVSS, EPSS, CISA KEV, threat intelligence, asset criticality, and attack paths.
- Investigate security alerts and suspicious activities across endpoint, network, identity, and cloud environments, supporting incident triage, containment, and escalation.
- Conduct threat hunting using endpoint detection, network monitoring, cloud security, and SIEM data, including investigations into emerging AI-enabled threats.
- Support application security activities such as SAST, DAST, SCA, code review findings, and security testing within CI/CD pipelines.
- Reconcile asset and scan data across security tools and ServiceNow CMDB, identify coverage gaps, and support continuous external attack surface monitoring.
- Troubleshoot security tool integrations, support vulnerability aggregation platforms like Vulcan, and contribute to automation, scripting, dashboards, and reporting.
- Participate in security testing, purple-team exercises, tool evaluations, and AI-assisted security initiatives.
- Maintain accurate incident records, handover documentation, remediation trackers, and reporting inputs for security governance.
- Participate in a shared 24/7 on-call rotation, respond to escalations within agreed timelines, and coordinate with SOC/MXDR providers and internal security teams.

Required Qualifications

- 3 to 5 years of experience in security operations, vulnerability management, or cybersecurity engineering within an enterprise environment.
- Hands-on experience with vulnerability management and security tools such as Tenable, CrowdStrike Falcon, Darktrace, Microsoft Defender, and GitHub Advanced Security; familiarity with Vulcan or similar platforms is a plus.
- Strong understanding of vulnerability assessment and risk-based prioritization frameworks including CVSS, EPSS, CISA KEV, threat intelligence, and remediation tracking.
- Proven experience in incident response, security alert triage, and threat hunting across endpoint, network, identity, and cloud environments.
- Working knowledge of Windows, Linux, Azure, networking, enterprise infrastructure, SSDLC, CI/CD, and application security testing methodologies including SAST, DAST, and SCA.
- Experience with ticketing systems such as ServiceNow or Jira, along with data querying skills using KQL or SQL and reporting tools like Excel or Power BI.
- Awareness of emerging cybersecurity threats, including AI-assisted vulnerability discovery, AI-enabled ransomware, and agentic AI abuse.
- Strong analytical, troubleshooting, communication, and stakeholder coordination skills, with the ability to adapt to changing priorities and participate in an on-call rotation.

Preferred Qualifications and Benefits

- Experience in financial services or insurance sectors.
- Background in penetration testing, red or purple teaming, and AI security testing.
- Familiarity with CMDB and asset management processes.
- Scripting skills using Python or PowerShell.
- Relevant certifications such as Security+, CySA+, GCIH, OSCP, or vendor-specific security credentials.

This role offers the opportunity to work in a dynamic, global environment where innovation and continuous improvement in cybersecurity practices are highly valued. Candidates who thrive in collaborative settings and are eager to contribute to advanced security initiatives will find this position rewarding.