Advanced Cyber Threat Analyst – Hybrid, AI‑Driven Defense

M&G plc; City of Edinburgh; On-site; GBP 70,000 - 120,000; Full time

Benefits offered by this job

Pension up to 18%

Share Save & Share Incentive Plan

38 days annual leave

Time Off When You Need It

Private Healthcare & Life Assurance

Job summary

M&G plc is seeking an Advanced Cyber Threat Analyst to join Security Operations. You will investigate complex security incidents, perform intelligence-led threat hunts and develop detections across cloud, endpoint, identity, email and network environments.

You will collaborate with Threat Intelligence, Security Operations Engineering and external providers to reduce cyber risk and strengthen defenses, while maintaining rigorous documentation and audit trails.

Qualifications

• Practical experience in a Security Operations environment.
• Strong capability in cyber incident investigation and response.
• Experience analysing activity across endpoint, identity, cloud, email or network security technologies.
• Experience structured, intelligence-led threat hunting; ability to develop, tune or validate security detections and analytical rules.
• Understanding of how threat intelligence and adversary behaviours can inform investigations, threat hunts and detection improvements.
• Experience using security data and evidence to assess risk and recommend proportionate actions.
• Knowledge of Microsoft Azure security environments, including Entra and Microsoft Defender capabilities.
• Sound judgement with incomplete, conflicting or time-sensitive information.
• Strong documentation, governance and audit discipline.
• Knowledge of responsible AI-assisted security operations, including the need for human oversight and validation.

Responsibilities

• Investigate complex security incidents across cloud, endpoint, identity, email and network environments.
• Assess the potential business impact of incidents and recommend proportionate containment, remediation and recovery actions.
• Maintain accurate investigative records, evidence and decision rationales throughout the incident lifecycle.
• Conduct intelligence-led threat hunts based on adversary campaigns, behaviours, tactics, techniques and procedures.
• Identify attack paths, security weaknesses, detection gaps and opportunities to strengthen M&G’s security posture.
• Translate investigation, threat hunting and threat intelligence findings into improved detections, controls and response processes.
• Develop, tune and validate analytical rules to ensure they remain effective against evolving threats and reduce unnecessary alert activity.
• Work with Security Operations Engineering to improve telemetry, data quality, detection coverage, tooling integrations and automated workflows.
• Use AI-assisted analysis and advanced analytics to support triage, investigation, threat hunting, detection engineering and reporting.
• Validate AI-generated outputs and retain accountability for analytical conclusions, response decisions and security recommendations.
• Act as a technical escalation point for complex alerts and incidents requiring advanced investigation or specialist expertise.
• Communicate complex threats, risks, decisions and recommendations clearly to both technical and non-technical stakeholders.
• Collaborate with internal teams and external security service providers to coordinate effective investigation and response activity.
• Identify and deliver practical improvements to Security Operations processes, procedures and defensive capabilities.
• Maintain effective controls, documentation and audit evidence, supporting internal and external audit activity where required.

Skills

Security operations experience

Cyber incident investigation

Threat hunting

Detections & analytics development

Threat intelligence & adversary behav.

Risk assessment & containment

Azure security environments (Entra, Df

Documentation & audit discipline

Responsible AI security ops oversight

Tools

Microsoft Defender for Endpoint

Microsoft Sentinel

Azure cloud security

Job description

M&G plc is seeking an Advanced Cyber Threat Analyst to join Security Operations. You will investigate complex security incidents, perform intelligence-led threat hunts and develop detections across cloud, endpoint, identity, email and network environments.

You will collaborate with Threat Intelligence, Security Operations Engineering and external providers to reduce cyber risk and strengthen defenses, while maintaining rigorous documentation and audit trails.