Incident Response Analyst

Advanced Resource Managers Ltd; Greater London; Presencial; GBP 55.000 - 85.000; Jornada completa

Descripción de la vacante

Advanced Resource Managers Ltd. seeks an experienced Incident Response Analyst to detect, triage and coordinate resolution of cyber security incidents across a complex enterprise environment.

You will investigate alerts, contain threats, and support post-incident reviews to drive improvements. The role requires hands-on experience with SIEM/EDR, Windows/Linux artefact analysis and knowledge of MITRE ATT&CK, NIST guidance and cloud/security fundamentals.

Formación

• Hands-on experience investigating security alerts and incidents using SIEM and EDR/XDR technologies.
• Experience analysing Windows and Linux host artefacts, authentication activity, security logs, network traffic and packet captures.
• Understanding of attacker behaviours and frameworks including MITRE ATT&CK, Cyber Kill Chain and NIST incident response guidance.
• Knowledge of enterprise networking, identity and access management, cloud services, email security, endpoint security, vulnerability management and data loss prevention.
• Experience producing incident records, investigation reports, management updates and post-incident findings.

Responsabilidades

• Monitor, triage and investigate cyber security alerts and incidents across enterprise environments.
• Lead and support incident response activities, including containment, eradication and recovery.
• Conduct digital forensic investigations to determine scope, root cause and impact of security incidents.
• Analyse endpoint, network, cloud and identity-based security events to identify threats and compromised assets.
• Perform proactive threat hunting and develop detection rules to improve security monitoring capabilities.
• Maintain accurate incident records, produce investigation reports and provide updates to technical and senior stakeholders.
• Support post-incident reviews, root cause analysis and implementation of lessons learned.
• Develop and maintain incident response playbooks, procedures and governance documentation.
• Contribute to cyber exercises, simulations and continual improvement of the organisation's security posture.
• Collaborate with technology, business, risk, compliance and third-party teams throughout the incident lifecycle.

Conocimientos

Incident response

Security monitoring

SIEM

EDR/XDR

Windows forensics

Linux forensics

Incident response lifecycle

Reports & updates

MITRE ATT&CK

NIST guidance

Networking basics

Cloud services

PowerShell

Python

KQL

Sentinel

Defender XDR

Defender for Identity

Defender for Cloud

EnCase

FTK

Wireshark

Educación

Bachelor’s degree in Cyber Security or Computer Science

Equivalent practical experience

Herramientas

SIEM

EDR/XDR

Sentinel

Defender XDR

Defender for Identity

Defender for Cloud

EnCase

FTK

Wireshark

Descripción del empleo

Overview

We are seeking an experienced Incident Response Analyst to join a growing Cyber Security function. This role is responsible for detecting, triaging, investigating and coordinating the resolution of cyber security incidents across a complex enterprise environment. The successful candidate will play a key role in reducing business risk, improving cyber resilience and enhancing incident response capabilities through threat hunting, digital forensics and continuous security improvement.

Key Responsibilities

• Monitor, triage and investigate cyber security alerts and incidents across enterprise environments.
• Lead and support incident response activities, including containment, eradication and recovery.
• Conduct digital forensic investigations to determine scope, root cause and impact of security incidents.
• Analyse endpoint, network, cloud and identity-based security events to identify threats and compromised assets.
• Perform proactive threat hunting and develop detection rules to improve security monitoring capabilities.
• Maintain accurate incident records, produce investigation reports and provide updates to technical and senior stakeholders.
• Support post-incident reviews, root cause analysis and implementation of lessons learned.
• Develop and maintain incident response playbooks, procedures and governance documentation.
• Contribute to cyber exercises, simulations and continual improvement of the organisation's security posture.
• Collaborate with technology, business, risk, compliance and third-party teams throughout the incident lifecycle.

Skills & Experience

Essential

• Practical experience in cyber incident response, security monitoring or a Security Operations Centre environment.
• Hands-on experience investigating security alerts and incidents using SIEM and EDR/XDR technologies.
• Experience analysing Windows and Linux host artefacts, authentication activity, security logs, network traffic and packet captures.
• Working knowledge of incident response lifecycle activities including preparation, detection, analysis, containment, eradication, recovery and lessons learned.
• Experience producing incident records, investigation reports, management updates and post-incident findings.
• Understanding of attacker behaviours and frameworks including MITRE ATT&CK, Cyber Kill Chain and NIST incident response guidance.
• Knowledge of enterprise networking, identity and access management, cloud services, email security, endpoint security, vulnerability management and data loss prevention.
• Ability to manage multiple priorities, exercise sound judgement under pressure and communicate clearly with technical and senior stakeholders.
• Awareness of evidence handling, forensic integrity, confidentiality and regulatory considerations relevant to cyber investigations.

Desirable

• Experience in banking, financial services or another regulated environment.
• Experience with threat intelligence, malware analysis, scripting or automation using PowerShell, Python, KQL or similar languages.
• Experience developing detection rules, response playbooks, threat hunts or security orchestration and automation workflows.
• Knowledge of Microsoft security technologies such as Sentinel, Defender XDR, Defender for Identity and Defender for Cloud, or equivalent platforms.
• Exposure to forensic tools such as EnCase, FTK, Velociraptor, Volatility, Wireshark or equivalent.
• Understanding of cloud investigation techniques across Microsoft Azure, Microsoft 365 or other major cloud platforms.

Qualifications

• Relevant professional experience supported by a degree in Cyber Security, Computer Science or a related discipline, or equivalent practical experience.
• One or more relevant certifications such as GCIH, GCIA, GCFA, GNFA, SC-200, CySA+, CISSP or equivalent are desirable.
• Sound knowledge of information security principles, recognised standards and regulatory expectations, including NIST, CIS Controls and relevant privacy requirements.