Incident Response Analyst: AI-Driven SOC & Assurance

American Express; England; On-site; GBP 50,000 - 80,000; Full time

Job summary

American Express is seeking an Incident Response Analyst to join its Cybersecurity Operations team in the UK. The role combines alert triage with advanced investigation and response to confirmed malicious activity, with a focus on AI-enabled security capabilities.

Ideal candidates will have SOC experience, knowledge of security tools, and strong analytical skills to produce evidence-based conclusions from logs and telemetry across multiple sources. Employment eligibility in the UK is required.

Qualifications

• Experience in a SOC, incident response, or cybersecurity operations.
• Knowledge of threat actor TTPs and telemetry analysis.
• Familiarity with enterprise security tools (SIEM, EDR/XDR/NDR) and cloud security practices.

Responsibilities

• Monitor and investigate security alerts and incidents across endpoints, identities, networks and cloud environments.
• Coordinate containment actions and document incident timelines and decisions.
• Collaborate with threat intel, detection engineering and business teams to improve detections and playbooks.
• Contribute to post-incident reviews and lessons learned to drive automation and AI-enabled improvements.

Skills

Security operations

Incident response

Threat intelligence

AI literacy

Analytical skills

SIEM/EDR/XDR

Education

Bachelor's degree in CS/IT or related

Tools

SIEM

EDR/XDR/NDR

Identity security tools

Cloud security tools

Job description

American Express is seeking an Incident Response Analyst to join its Cybersecurity Operations team in the UK. The role combines alert triage with advanced investigation and response to confirmed malicious activity, with a focus on AI-enabled security capabilities.

Ideal candidates will have SOC experience, knowledge of security tools, and strong analytical skills to produce evidence-based conclusions from logs and telemetry across multiple sources. Employment eligibility in the UK is required.