Cyber Security Analyst

Leonardo UK Ltd; Bristol; Hybrid; GBP 40,000 - 55,000; Full time

Job summary

A leading aerospace and defense company is seeking a Cyber Security Analyst in Bristol. The role involves providing monitoring and incident handling services in a 24/7 operational context. Candidates should have excellent communication skills, experience in Cyber Security, and familiarity with SIEM tools. The organization offers a hybrid working environment, generous leave, and a comprehensive benefits package.

Benefits

Generous leave with up to 12 additional flexi-days per year

Pension scheme with up to 15% employer contribution

Free access to mental health support

Bonus scheme for management level and below

Access to 4,000+ online courses

Flexible benefits including private healthcare

Hybrid working options

Qualifications

• Strong knowledge of common attack types and detection/prevention methods.
• Ability to work under pressure and handle multiple incidents.
• Experience with threat intelligence.

Responsibilities

• Provide monitoring and incident handling services.
• Act as the initial analytical reference point for security incidents.
• Collaborate with the Incident Response Team on containment measures.

Skills

Excellent communication at all levels

Experience in Cyber Security

SIEM experience (LogRhythm, ArcSight, Splunk, etc.)

Strong knowledge of IT security best practices

Experience analysing system logs

Strong organisational skills

Ability to work independently and as part of a team

Highly motivated and willing to learn

Ability to work within a Hybrid Remote Working shift pattern

Tools

Security Information and Event Management (SIEM)

Intrusion Detection Systems (IDS)

Job description

Overview

Job Description: We are looking for a Cyber Security Analyst to join the ARCHANGEL ProMon Team. ARCHANGEL delivers specialist technical cyber security services to clients across industries including construction, government, defence and aerospace. The ARCHANGEL ProMon Team sits within the Bristol Service Operations Centre (SOC) and provides initial investigation into anomalous network activity that may lead to potential security incidents. Leonardo and its Cyber Security division are leaders in safety-through-technology, serving customers in public administration, public safety and security, critical infrastructure, services, transport, post and logistics. You will join our Bristol team and contribute to Leonardo's future. We are committed to a work environment that promotes well-being and balance for all employees.

So let’s get down to what you will do as a Cyber Security Analyst!

Responsibilities

• Provide monitoring, alerting and incident handling services within the SOC in line with SLAs and within the 24/7/365 shift pattern
• Act as the initial analytical reference point for identifying and quantifying the nature and extent of security incidents, and offer initial professional advice relating to possible business impact to reduce Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR)
• Advise on incident containment measures through recommended initial actions to customers in collaboration with the Incident Response (IR) Team
• Provide advice relating to potential mitigation measures to prevent or limit future reoccurrence in collaboration with the IR Team
• Understand Incident Response, Cyber Kill Chain, Threat Modelling and pertinent Attack Vectors
• Collaborate across the team to create pertinent Playbooks and Use Cases
• Perform proactive analysis across client networks by staying abreast of current threats and trends
• Develop and maintain knowledge of current and emerging threats affecting the managed service
• Review recurring false positive firings and assist in tuning SIEM and IDS rules to reduce false positives and maintain effective security alerting
• Ensure all operational incidents, ongoing tickets and relevant information are handed over to the oncoming shift using the shift handover process
• Assist in the creation of reporting for management and clients on security incidents and threat intelligence trends when required

What you’ll bring

• Excellent communication at all levels; ability to work with customers and clearly explain what is happening
• Experience in Cyber Security, e.g. Protective Monitoring, Incident Response, Security Engineering
• SIEM (LogRhythm, ArcSight, Splunk, etc) and IDS (Snort) experience
• Strong knowledge of IT security best practices, common attack types and detection/prevention methods
• Experience analysing and interpreting system, security and application logs to diagnose faults and identify abnormal behaviours
• Strong organisational skills and attention to detail
• Ability to work independently and as part of a team
• Highly motivated with the aptitude to learn new skills
• Ability to work within a Hybrid Remote Working shift pattern covering 24/7/365 operations
• Occasional travel may be required

Additional Skills

• SANS SEC 503 Intrusion Detection in Depth or equivalent
• SANS SEC 504 Incident Handling, Hacker Tools and Techniques or equivalent
• SANS SEC 508 Advanced Incident Response, Threat Hunting, and Digital Forensics or equivalent
• SANS SEC 511 Continuous Monitoring and Security Operations or equivalent
• Exposure to IT service management best practices such as ITIL
• Knowledge of standards and guidelines such as ISO27001, GDPR principles and GPG-13
• Threat Intelligence experience
• Report Writing

This is not an exhaustive list; we welcome applicants even if you do not have experience in all the items above. The most important skill is a good attitude and willingness to learn.

Security Clearance

This role is subject to pre-employment screening in line with the UK Government’s Baseline Personnel Security Standard (BPSS). Personnel applying must have the ability to obtain SC clearance at a minimum. An additional range of Personnel Security Controls referred to as National Security Vetting (NSV) may apply; this could include meeting the eligibility requirements for The Security Check (SC) or Developed Vetting (DV).

For more information and guidance please visit: https://careers.uk.leonardo.com/gb/en/security-and-vetting

Why join us

Leonardo is committed to building an inclusive, accessible, and welcoming workplace. We offer a comprehensive, company-funded benefits package supporting wellbeing, career development, and work–life balance.

• Time to Recharge: Generous leave with up to 12 additional flexi-days per year.
• Secure your Future: Pension scheme with up to 15% employer contribution.
• Your Wellbeing Matters: Free access to mental health support, financial advice, and employee networks promoting inclusion and diversity.
• Rewarding Performance: Bonus scheme for management level and below.
• Never Stop Learning: Access to 4,000+ online courses via Coursera and LinkedIn Learning.
• Refer a friend: Refer-a-friend rewards.
• Tailored Perks: Flexible benefits including private healthcare, dental, family cover, discounts, and more.
• Flexible working: Hybrid options; discuss part-time possibilities for this role.

For a full list of company benefits please visit our website.

Leonardo is a global leader in Aerospace, Defence, and Security. We employ over 53,000 people worldwide, with significant UK presence. We are committed to an inclusive, accessible workplace and welcome applicants with accessibility requirements.

Be part of something bigger - apply now!

Primary Location: GB - Bristol - Coldharbour Lane

Contract Type: Permanent

Hybrid Working: Onsite