Global 24/7 Security Operations Analyst

JPMorgan Chase & Co.; City Of London; On-site; GBP 70,000 - 100,000; Full time

Job summary

JPMorgan Chase & Co. in London seeks a hands-on Security Operations Analyst to triage alerts, investigate incidents end-to-end, and contribute to threat hunting and detection engineering.

You will work within a follow-the-sun model providing 24/7 coverage and collaborate with global SOC teams across endpoints, networks, cloud, and identity telemetry. The role emphasizes continuous improvement of detection content and runbooks, with strong emphasis on communication and documentation to

Qualifications

• 2+ years in a SOC, IR, or security analyst role.
• Solid monitoring/investigation experience across SIEM, EDR/XDR, and network tooling.
• Working knowledge of attack techniques and MITRE ATT&CK framework.

Responsibilities

• Triage and analyze security alerts from SIEM, EDR, and other tooling.
• Investigate incidents end-to-end from detection to containment and recovery.
• Conduct proactive threat hunting across endpoints, networks, cloud, and identity telemetry.
• Contribute to detection engineering by tuning rules and use cases.
• Leverage AI-assisted tools to accelerate investigations and improve efficiency.
• Document findings and produce incident reports and post-incident reviews.
• Collaborate with global SOC teams for seamless handoffs under follow-the-sun model.
• Improve SOC playbooks, runbooks, and SOPs.
• Stay current with threat landscape and industry best practices.

Skills

SOC experience

SIEM/EDR

MITRE ATT&CK

Networking basics

OS internals

Log analysis

Documentation & comms

Weekend rotation

Education

Bachelor's in CS/InfoSec

Tools

Sigma

YARA

KQL

SPL

SOAR

Job description

JPMorgan Chase & Co. in London seeks a hands-on Security Operations Analyst to triage alerts, investigate incidents end-to-end, and contribute to threat hunting and detection engineering.

You will work within a follow-the-sun model providing 24/7 coverage and collaborate with global SOC teams across endpoints, networks, cloud, and identity telemetry. The role emphasizes continuous improvement of detection content and runbooks, with strong emphasis on communication and documentation to