Cyber Security Analyst

Digital Waffle; Greater London; On-site; GBP 42,000 - 70,000; Full time

Benefits offered by this job

On-Call Allowance

Benefits

Job summary

Digital Waffle is seeking an experienced Security Analyst to join a 24/7 Security Operations Centre supporting critical national security programmes in London. You will monitor, detect and respond to cyber threats across enterprise environments using Elastic and Splunk, escalating and coordinating with engineering and incident response teams.

The role requires Active SC Clearance, British nationality, and willingness to work a 24/7 rotating shift pattern.

Qualifications

• Experience in a 24/7 Security Operations Centre or equivalent cyber security environment.
• Strong hands-on experience using Elastic and Splunk for security monitoring.
• Good understanding of SIEM technologies, log analysis and threat detections.
• Knowledge of MITRE ATT&CK and the Cyber Kill Chain
• Experience investigating phishing, malware, endpoint, identity and network security incidents
• Familiarity with Windows, Linux, Active Directory and cloud environments (AWS, Azure or Microsoft 365)
• Strong analytical and problem-solving skills with the ability to make decisions under pressure
• Excellent written and verbal communication skills
• Active SC Clearance
• British National, with eligibility to obtain higher levels of UK security clearance
• Willingness to work a 24/7 rotating shift pattern (4 days on rotation)
• Able to work from the London office as required

Responsibilities

• Monitor security alerts and events across enterprise environments using Elastic and Splunk
• Investigate, triage and respond to security incidents in line with established playbooks and SLAs
• Perform threat hunting and proactive analysis to identify malicious activity
• Analyse logs from endpoints, networks, cloud services and security tools to detect suspicious behaviour
• Escalate incidents where appropriate and work closely with engineering and incident response teams
• Develop and improve SIEM detection rules and alert tuning to reduce false positives
• Produce clear incident reports and maintain accurate documentation
• Participate in the on-call rota and support major incident response when required
• Contribute to the continuous improvement of SOC processes, tooling and operational procedures

Skills

SOC operations

SIEM

Threat hunting

Log analysis

Incident response

Analytical thinking

Communication skills

Active SC Clearance

Tools

Elastic

Splunk

Job description

Location: London (On-site Shift Pattern)

Salary: Up to £70,000 + On-Call Allowance + Benefits

Security Clearance: Active SC Clearance required (Must be a British National and eligible to obtain higher levels of UK security clearance)

We're working with a leading organisation supporting critical national security programmes, who are looking to recruit an experienced Security Analyst to join their 24/7 Security Operations Centre (SOC)

You'll play a key role in monitoring, detecting and responding to cyber security threats across complex enterprise environments, working with industry-leading technologies including Elastic and Splunk. This is an excellent opportunity for someone who thrives in a fast-paced operational environment and enjoys working on high-profile, mission-critical systems.

Key Responsibilities

• Monitor security alerts and events across enterprise environments using Elastic and Splunk
• Investigate, triage and respond to security incidents in line with established playbooks and SLAs
• Perform threat hunting and proactive analysis to identify malicious activity.
• Analyse logs from endpoints, networks, cloud services and security tools to detect suspicious behaviour
• Escalate incidents where appropriate and work closely with engineering and incident response teams
• Develop and improve SIEM detection rules and alert tuning to reduce false positives
• Produce clear incident reports and maintain accurate documentation
• Participate in the on-call rota and support major incident response when required
• Contribute to the continuous improvement of SOC processes, tooling and operational procedures

Skills & Experience

• Experience working within a 24/7 Security Operations Centre (SOC) or equivalent cyber security environment
• Strong hands-on experience using Elastic and/or Splunk for security monitoring and investigations
• Good understanding of SIEM technologies, log analysis and threat detections
• Knowledge of security frameworks such as MITRE ATT&CK and the Cyber Kill Chain
• Experience investigating phishing, malware, endpoint, identity and network security incidents
• Familiarity with Windows, Linux, Active Directory and cloud environments (AWS, Azure or Microsoft 365)
• Strong analytical and problem-solving skills with the ability to make decisions under pressure
• Excellent written and verbal communication skills
• Active SC Clearance
• British National, with eligibility to obtain higher levels of UK security clearance
• Willingness to work a 24/7 rotating shift pattern (4 days on rotation)
• Able to work from the London office as required