Cyber Defence SecOps Analyst

We are seeking a skilled Cyber Defence SecOps Analyst to join our team, bringing expertise in security operations, vulnerability management, incident response, and threat hunting. This role involves supporting vulnerability assessment and remediation efforts, investigating security incidents, managing asset and scan coverage, and maintaining security tooling within a global enterprise environment. The ideal candidate will have hands-on experience with enterprise security tools, risk-based vulnerability prioritisation, and security automation. Flexibility to support multiple workstreams and participate in a shared 24/7 on-call rota is essential.

Key Responsibilities

- Analyse and prioritise vulnerabilities from various sources, including Tenable, Microsoft Defender, CrowdStrike Falcon, Darktrace, GitHub Advanced Security, and application security testing tools.
- Track vulnerabilities from identification through to closure, coordinating remediation efforts with infrastructure, cloud, application, and platform teams, and validating remediation evidence.
- Prioritise exposures based on exploitability, CVSS, EPSS, CISA KEV, threat intelligence, asset criticality, and attack paths.
- Investigate security alerts and suspicious activities across endpoint, network, identity, and cloud environments, supporting incident triage, containment, and escalation processes.
- Conduct threat hunting using endpoint detection, network monitoring, cloud security, and SIEM data, including investigations into emerging AI-enabled threats.
- Support application security activities, including SAST, DAST, SCA, code review findings, and security testing within CI/CD pipelines.
- Reconcile asset and scan data across security tools and the ServiceNow CMDB, identify coverage gaps, and support continuous external attack surface monitoring.
- Troubleshoot security tool integrations, support vulnerability aggregation platforms such as Vulcan, and contribute to automation, scripting, dashboards, and reporting.
- Participate in security testing, purple-team exercises, tool evaluations, and AI-assisted security initiatives.
- Maintain accurate incident records, handover documentation, remediation trackers, and reporting inputs to support security governance.
- Participate in a shared 24/7 on-call rota, respond to escalations within agreed timelines, and coordinate with SOC/MXDR providers and internal security teams.

Required Qualifications

- 3 to 5 years of experience in security operations, vulnerability management, or cybersecurity engineering within an enterprise environment.
- Hands-on experience with vulnerability management and security tools such as Tenable, CrowdStrike Falcon, Darktrace, Microsoft Defender, and GitHub Advanced Security; familiarity with Vulcan or similar platforms is preferred.
- Strong understanding of vulnerability assessment and risk-based prioritisation, including CVSS, EPSS, CISA KEV, threat intelligence, and remediation tracking.
- Experience in incident response, security alert triage, and threat hunting across endpoint, network, identity, and cloud environments.
- Working knowledge of Windows, Linux, Azure, networking, enterprise infrastructure, SSDLC, CI/CD, and application security testing methodologies including SAST, DAST, and SCA.
- Experience with ServiceNow or Jira for ticket management, along with data querying using KQL or SQL and reporting tools such as Excel or Power BI.
- Awareness of emerging cybersecurity threats, including AI-assisted vulnerability discovery, AI-enabled ransomware, and agentic AI abuse.
- Strong analytical, troubleshooting, communication, and stakeholder coordination skills, with the ability to adapt to changing priorities and participate in an on-call rotation.

Preferred Qualifications and Benefits

- Experience in financial services or insurance sectors.
- Background in penetration testing, red/purple teaming, and AI security testing.
- Familiarity with CMDB and asset management.
- Scripting skills using Python or PowerShell.
- Relevant certifications such as Security+, CySA+, GCIH, OSCP, or vendor-specific security certifications.

This role offers the opportunity to work in a dynamic, global environment where security innovation and continuous improvement are valued. Candidates who thrive in fast-paced settings and are committed to enhancing enterprise security posture will find this position rewarding.