Cyber Security Analyst

First Military Recruitment Ltd; City Of London; Hybrid; GBP 83,000 - 120,000; Full time

Job summary

First Military Recruitment are currently seeking a Cyber Security Analyst for a client in London. The role sits 60% onsite and involves supporting the cyber defence team in securing digital assets and responding to incidents.

The successful candidate will investigate alerts, use SIEM/EDR tools, and contribute to post-incident reviews, with a contract until 31/03/2027 and IR35 in scope.

Qualifications

• Experience investigating and responding to cyber incidents.
• Experience using security tools (EDR, SIEM) to support investigations and responses.
• Experience with SIEM tools (Splunk preferred; MS Sentinel acceptable).
• Understanding of tools, techniques, and procedures used by threat actors.
• Good analytical and problem-solving skills.
• Good verbal and written communication skills.
• Active SC clearance.
• 2–3 years in a Cyber Security Analyst role.
• Experience with M365 Defender / Sentinel / KQL.

Responsibilities

• Triage and investigate cyber security alerts and reports from users.
• Analyse systems, network traffic and cloud environments to determine incident scope.
• Support containment, eradication and recovery actions during incidents.
• Coordinate cyber incident response and contribute to post-incident reviews.
• Provide coaching and mentoring to apprentice security analysts.

Skills

Cyber incident response

EDR/SIEM tools

Splunk/M365 Sentinel

Threat actor techniques

Analytical thinking

Communication skills

Active SC clearance

2-3 years experience

M365 Defender/KQL

Job description

HM76: Cyber Security Analyst

Location: London 60% onsite

Salary: Competitive Day Rate Contract until 31/03/2027 IR35: In Scope

Overview

First Military Recruitment are currently seeking a Cyber Security Analyst Designer on behalf of one of our clients.

The successful candidate will support our clients Cyber and Information Security function. Their mission is to secure digital and information assets against misuse and enable the secure delivery of the department s mission. They do this by developing, operating and governing the cyber and information security controls which protect our nationwide internal IT infrastructure, and high–profile citizen–facing digital services. This role is within the Cyber Defence team, which is responsible for understanding, detecting and responding to cyber threats and vulnerabilities impacting our client. This role is responsible for supporting their alert triage and incident response capability.

Our client encourages applications from ex–military personnel however all candidates will be given due consideration.

Duties and Responsibilities

• Triage and investigate cyber security alerts and reports from users.
• Use a variety of techniques to analyse systems, files, network traffic and cloud environments and understand the nature and extent of possible cyber incidents.
• Support the technical response to cyber incidents by identifying and implementing (or supporting the implementation of) containment, eradication and recovery actions.
• Support the coordination of cyber incidents.
• Contribute to post–incident reviews to identify lessons and actions.
• Identify opportunities for, and support the delivery of, continual improvements to the incident investigation and response capability.
• Work closely alongside other Cyber Defence functions, supporting the continual improvement of wider capabilities.
• Contribute to internal plans, playbooks and knowledge base articles.
• Act as an escalation point for, and provide coaching and mentoring to, apprentice security analysts.
• Be responsible for line management of apprentice security analysts.
• Cyber incidents can and do arise on a 24/7 basis. The team operates an out–of–hours on call rota, which you will be expected to join.

Skills and Qualifications

• Experience investigating and responding to cyber incidents.
• Experience using security tools (e.g., EDR, SIEM) to support the investigation and response to cyber incidents.
• Experience with SIEM tools (experience of Splunk preferred but experience of Microsoft Sentinel or an equivalent SIEM tool is acceptable).
• An understanding of the tools, techniques and procedures commonly used by threat actors.
• Good analytical and problem–solving skills.
• Good verbal and written communication skills.
• Active SC clearance.
• At least 2–3 years experience in a position of Cyber Security Analyst.
• Working experience of M365 (Microsoft Defender / Sentinel / KQL).

Desirable

• Experience with Splunk.
• Experience working in an Agile environment.
• Experience with cloud environments such as AWS.