Cybercrime Analyst - Weekends included

EducationPals; Bath; Hybrid; GBP 55,000 - 85,000; Full time

Job summary

EducationPals in Bath is seeking a security operations professional to join our team. The role covers cybercrime incident response, classification of digital assets, and delivering clear feedback to customers on incidents and classifications.

You will work on detection engineering, build automation guardrails, and measure response speed while collaborating with senior staff to improve processes and workflows in a hybrid Bath office.

Qualifications

• Experience with security operations lifecycle: intake, triage, investigation, containment, recovery, learning.
• Ability to build disciplined triage systems by severity and context.
• Experience in writing scalable detection rules and automation guardrails.

Responsibilities

• Lead cybercrime incident response and communicate threat analysis to stakeholders.
• Classify websites, profiles, apps, emails, and phone numbers.
• Develop detection logic that scales and reduces false positives.
• Create response playbooks and guardrails for automation.
• Measure dwell time and response speed to improve operations.
• Coordinate adversarial testing and red/purple team exercises.
• Explore AI-assisted operations and guardrails to prevent hallucination and data leakage.

Skills

Incident response

Threat detection

Triage & investigation

Automation & playbooks

AI in security

Job description

Day to day, your responsibilities will include: Cybercrime incident response – communicating analysis of cyber threats to relevant parties to mitigate attacks; Classification of malicious websites, social media profiles, apps, emails, and phone numbers; Providing clear and professional feedback to customers on incidents and classifications; Sharing your ideas on how to improve processes and workflows. Based at our Bath office, but with hybrid flexibility, you’ll report directly to a more senior

Relevance is based on skills and concepts, not a guarantee that you qualify.

Understand how security operations turns signals into action through intake, triage, investigation, containment, recovery, and learning.

2. Triage Frameworks and Alert Prioritization

Build disciplined triage systems that route alerts by severity, business context, and attacker intent.

3. Detection Engineering: Writing Rules That Scale

Design detection logic that catches real attacks, minimizes false positives, and adapts as adversaries change tactics.

4. Response Playbooks and Automation Guardrails

Build playbooks that automate low-risk actions and preserve human judgment for decisions that require context and accountability.

5. Measuring Time Advantage: Dwell Time and Response Speed

Track metrics that reveal whether your operations can act faster than attackers can achieve their objectives.

6. Adversarial Testing: Red Teams and Purple Team Exercises

Simulate realistic attack scenarios to test whether your detection, triage, and response processes can keep up under pressure.

7. AI Assisted Operations and New Failure Modes

Understand how AI tools can accelerate triage and investigation, and what guardrails prevent hallucination, prompt injection, and data leakage.