Cyber Defence Analyst

A&O Shearman; Belfast City District; On-site; GBP 35,000 - 55,000; Full time

Job summary

A&O Shearman in Belfast is seeking a Cyber Defence Analyst to join the global Information Security team. This hands-on role investigates security alerts, responds to incidents and helps protect an international organisation from evolving cyber threats. Weekend work is required with premium pay for weekend hours.

You’ll work across incident response, threat detection, tooling and process improvement, gaining exposure across time zones in our 24/7 model.

Qualifications

• 1+ years in Security Operations, Cyber Defence, SOC, or similar.
• Experience across alert triage, incident response, detection or threat intel.
• Knowledge of SIEM, IDS/IPS, EDR, and firewalls.

Responsibilities

• Investigate escalations and prioritise security events and alerts.
• Respond to information security queries with guidance.
• Support incident response lifecycle from triage to remediation.
• Gather forensic evidence for investigations.
• Assist with 24/7 global coverage and on-call rotation.
• Help improve tooling, playbooks and documentation.
• Collaborate with IT and other teams to strengthen security posture.

Skills

Security Operations

Cyber Defence

Incident Response

Threat Detection

SIEM

IDS/IPS

EDR

TCP/IP

DNS

SMTP

DFIR

Communication

Tools

SIEM

IDS/IPS

EDR

Firewalls

Vulnerability Mgmt

Job description

We have an exciting opportunity for Cyber Defence Analysts to join our global Information Security team, based in the A&O Shearman’s Belfast office.

This is a hands‑on role for someone looking to build their career in Cyber Defence, working with a global team to investigate security alerts, respond to cyber incidents and help protect an international organisation from evolving cyber threats. You’ll gain exposure across a broad range of Cyber Defence activities while continuing to develop your technical expertise in areas such as incident response, threat detection, security tooling, and process improvement.

Please note that weekend working is a requirement for this role, with exact shift patterns discussed at interview. All weekend hours are eligible for a premium payment in addition to base salary.

What you will do

Investigate escalations

• Investigate and prioritise escalated cyber security events and alerts, identifying potential incidents and escalating where appropriate.
• Investigate potential cyber security and data loss incidents raised by employees or third parties, following established Cyber Defence playbooks.
• Respond to information security queries, working with colleagues across the team to provide appropriate guidance.

Incident Response

• Support incident response activities, including the initial triage, investigation, containment, mitigation and remediation of confirmed incidents.
• Gather and document relevant forensic evidence to support investigations.
• Participate in security incident response exercises and contribute to post‑incident and post‑exercise reviews.
• Work with Cyber Defence teams across different time zones as part of our 24/7 follow‑the‑sun global model, ensuring effective handover of ongoing incidents.
• Maintain awareness of emerging cyber threats, techniques and procedures, applying threat intelligence insights to day‑to‑day investigations.
• Participate in the Cyber Defence on‑call rota, including out‑of‑hours support where required.

Tooling and Process Improvement

• Support the implementation, enhancement and effective use of Cyber Defence tools and technologies.
• Help continuously improve Cyber Defence processes, playbooks and documentation.
• Identify opportunities to improve detection, investigation and response capabilities across the team.

Collaboration and Advisory

• Work closely with Information Security, IT and other teams to strengthen the firm’s overall security posture.
• Provide practical Cyber Defence guidance to stakeholders, translating complex technical issues into clear, business‑friendly language.

What you will have

• 1+ years’ experience in Security Operations, Cyber Defence, a SOC, or a similar technical security environment.
• Practical experience across at least two areas such as alert triage, incident response, security engineering, detection/rule writing, DFIR, threat intelligence, vulnerability management or security control testing.
• Working knowledge of key Cyber Defence technologies, including SIEM, IDS/IPS, endpoint protection/EDR, firewalls and threat or vulnerability management tooling.
• Strong networking fundamentals, particularly TCP/IP, DNS and SMTP.
• An analytical and investigative mindset, with the ability to assess alerts and data, identify potential security incidents and determine appropriate next steps.
• Strong communication skills and the ability to explain technical cyber security issues clearly to different audiences.

You will stand out if you have

• Digital Forensics & Incident Response (DFIR), including relevant incident response or forensic training/certification.
• Penetration testing or web application security/testing.
• Scripting or automation using Python and/or PowerShell.
• Security experience across Azure, AWS or GCP.
• Relevant cyber security qualifications or certifications, such as CompTIA Security+, CEH, CISSP or CISM.

NO AGENCIES PLEASE

A&O Shearman does not accept unsolicited CVs. For further information, please see our UK Recruitment Agency Policy and our commitment to direct sourcing here.