Incidence Response Analyst

Myn; Greater London; Ibrido; GBP 55.000 - 75.000; Tempo pieno

Vantaggi offerti da questo lavoro

Hybrid work arrangement (London office

Career growth opportunities

Continuous learning and certifications

Descrizione del lavoro

Myn is seeking an Incident Response Analyst to lead investigations across client environments in a hybrid role with one day per month in our London office. You will triage and investigate alerts from SIEM and EDR/XDR, coordinate containment and recovery, collect forensic artefacts, run threat hunts, and provide clear guidance to clients.

Ideal candidates have hands-on incident response experience, knowledge of MITRE ATT&CK and NIST, and strong communication under pressure.

Competenze

• Hands-on incident response, SOC or cyber defence experience confirmed by work history.
• Experience using SIEM/EDR/XDR tools to investigate and respond to incidents.
• Familiarity with incident response lifecycle, MITRE ATT&CK, Cyber Kill Chain and NIST.

Mansioni

• Triage and investigate alerts from SIEM, EDR/XDR, identity, email, cloud and network platforms; lead or support responses to phishing, malware, and unauthorized access
• Coordinate containment, eradication and recovery with internal teams and client stakeholders; maintain incident records and timelines
• Collect and analyse forensic artefacts from endpoints, servers, identity, email and cloud; preserve evidence integrity
• Run intelligence-led threat hunts; tune detection rules and close gaps uncovered during investigations
• Act as trusted adviser to clients; provide clear technical guidance and updates; conduct post-incident reviews
• Improve response plans, playbooks and runbooks; support tabletop exercises and purple-team activity

Conoscenze

Incident response experience

Clear written communication

Calm under pressure

Project coordination

Strumenti

Microsoft Sentinel

Defender

PowerShell

Python

KQL

Velociraptor

Volatility

Wireshark

Descrizione del lavoro

Incident Response Analyst – Hybrid (London office 1 day per month)

Full-time | Cyber Security team | Hybrid, with one day a month in the London office

About the role

A growing Cyber Security team is seeking an Incident Response Analyst who wants to lead investigations, not just triage alerts. You will work across a range of client environments, helping organisations contain incidents quickly and come out more resilient. You will also help shape the team’s incident response capabilities and services, so the lessons you learn on one case improve the next.

What you’ll be doing

• Triage and investigate alerts from SIEM, EDR/XDR, identity, email, cloud and network platforms, and lead or support responses to phishing, malware, account compromise and unauthorised access
• Coordinate containment, eradication and recovery with internal teams and client stakeholders, keeping clear incident records and timelines
• Collect and analyse forensic artefacts from endpoints, servers, identity, email and cloud, maintaining evidence integrity and chain of custody
• Run intelligence-led threat hunts, then tune detection rules and close gaps uncovered during investigations
• Act as a trusted advisor to clients, giving clear technical guidance, regular updates and post-incident reviews
• Improve response plans, playbooks and runbooks, and support tabletop exercises and purple-team activity

What we’re looking for

• Hands-on experience in incident response, SOC or cyber defence, investigating incidents with SIEM and EDR/XDR tools (essential)
• A solid grasp of the incident response lifecycle, and of MITRE ATT&CK, the Cyber Kill Chain and NIST frameworks (essential)
• Experience analysing Windows and Linux systems, authentication events, network traffic and security logs (essential)
• Clear written communication, from technical investigation reports to management updates
• Calm, organised delivery under pressure across several priorities
• Desirable: MSSP, consultancy or regulated-sector experience; Microsoft Sentinel and Defender; PowerShell, Python or KQL; forensic tools such as Velociraptor, Volatility or Wireshark; GCIH, GCFA, SC-200, CySA+ or CISSP

What you get

• Varied incident work across different client environments
• Competitive compensation
• Career growth opportunities
• Access to continuous learning and certifications
• Hybrid working, with just one day a month in the London office

This role suits

An analyst who enjoys the pressure and detail of live investigations, and wants to turn each incident into better detection and response.