Cybersecurity Incident Response Analyst

Careerwise; City Of London; On-site; GBP 55,000 - 85,000; Full time

Job summary

Careerwise is seeking a Cybersecurity Incident Response Analyst to join our global Security Operations Centre, helping detect, investigate, contain and resolve incidents across the EMEA region.

You will monitor SIEM/EDR/XDR alerts, triage incidents, coordinate containment with IT and security teams, and contribute to playbooks, post‑incident reviews and improved detection capabilities.

Experience with Windows/Linux artefacts, MITRE ATT&CK, NIST guidance and strong reporting is essential.

Qualifications

• Experience in cyber incident response and security monitoring.
• Hands-on experience investigating alerts using SIEM and EDR/XDR.
• Experience analysing Windows and Linux host artefacts and logs.
• Knowledge of the incident response life cycle.
• Experience producing incident records and post-incident findings.
• Familiar with MITRE ATT&CK, Cyber Kill Chain and NIST guidance.
• Understanding of core security domains: networking, IAM, email, endpoints, vulnerability management and data loss prevention.

Responsibilities

• Monitoring and analysing alerts from SIEM, EDR/XDR, identity, email, cloud and network controls to identify suspicious or malicious activity.
• Triaging alerts, validating incidents, assessing severity and business impact, and escalating per processes and SLAs.
• Leading or supporting investigations into phishing, malware, account compromise, data loss and unauthorised access.
• Coordinating containment, eradication and recovery with infrastructure, applications, identity, cloud and business teams.
• Maintaining case records, investigation timelines, evidence and decision logs.
• Collecting, preserving and analysing endpoint, server, identity, network, email and cloud artefacts.
• Identifying indicators of compromise and threat actor behaviour, and documenting findings clearly.
• Safeguarding evidence integrity and chain of custody in regulated investigations.
• Creating, tuning and validating detection rules and queries to improve coverage and reduce false positives.
• Assessing detection gaps and recommending improvements to logging, telemetry and controls.
• Developing, maintaining and exercising incident response plans and playbooks.
• Conducting post‑incident reviews and root‑cause analysis, tracking actions to closure.

Skills

Cyber incident response

Security monitoring

SOC operations

Windows forensics

Linux forensics

Incident reporting

Threat frameworks

Tools

SIEM

EDR/XDR

Job description

A Cybersecurity Incident Response Analyst is needed to join the Security Operations Centre of a global financial services organisation, helping to detect, investigate, contain and resolve cybersecurity incidents across the EMEA region.

You will be responsible for:

• Monitoring and analysing alerts from SIEM, EDR/XDR, identity, email, cloud and network controls to identify suspicious or malicious activity.
• Triaging alerts, validating incidents, assessing severity and business impact, and escalating in line with defined processes and service levels.
• Leading or supporting investigations into phishing, malware, account compromise, data loss, unauthorised access and suspicious network activity.
• Coordinating containment, eradication and recovery with infrastructure, application, identity, cloud and business teams.
• Maintaining case records, investigation timelines, evidence and decision logs.
• Collecting, preserving and analysing endpoint, server, identity, network, email and cloud artefacts.
• Identifying indicators of compromise and threat actor behaviour, and documenting findings in a clear, standardised format.
• Safeguarding evidence integrity and chain of custody in investigations with legal or regulatory implications.
• Creating, tuning and validating detection rules, queries and use cases to improve coverage and reduce false positives.
• Assessing detection gaps found during incidents and recommending improvements to logging, telemetry and controls.
• Developing, maintaining and exercising incident response plans, playbooks and call–out arrangements.
• Conducting post–incident reviews and root–cause analysis, and tracking corrective actions through to closure.

Required experience and skills:

• Experience in cyber incident response, security monitoring or a Security Operations Centre environment.
• Hands–on experience investigating alerts and incidents using SIEM and EDR/XDR technologies.
• Experience analysing Windows and Linux host artefacts, authentication activity, security logs, network traffic and packet captures.
• Working knowledge of the full incident response life cycle, from preparation through to lessons learned.
• Experience producing incident records, investigation reports, management updates and post–incident findings.
• Good understanding of cybersecurity frameworks and guidelines, including MITRE ATT&CK, the Cyber Kill Chain and NIST incident response guidance.
• Knowledge of core security domains, including enterprise networking, IAM, email and endpoint security, vulnerability management and data loss prevention.