Incident Response Analyst (Contract)

Curo Services; Greater London; Hybrid; GBP 69,000 - 124,000; Full time

Job summary

Curo Services is seeking an experienced Incident Response Analyst to join our growing Cyber Security function in London. The role covers the full incident lifecycle, including detection, triage, investigation and coordination with multiple teams.

You will monitor alerts from SIEM/EDR, conduct investigations into threats such as phishing and data loss, and maintain clear incident records with management-ready updates. 2 days on-site in London, flexible remote work for the rest of the week.

Qualifications

• Experience in incident response lifecycle and threat analysis.
• Ability to triage, investigate, and coordinate containment actions.
• Strong written and verbal communication with technical and business stakeholders.

Responsibilities

• Monitor and analyse alerts from SIEM, EDR/XDR, identity, email, cloud, network and other controls.
• Triage alerts, validate incidents, determine severity and business impact, escalate per process.
• Lead or support investigations into threats such as phishing, malware, account compromise and data loss.
• Coordinate containment, eradication and recovery with infra, apps, identity, cloud and business teams.
• Maintain incident records, timelines, evidence and closure rationale.
• Provide timely incident updates and concise reports with impact, risk and next steps.

Skills

Incident response

Threat hunting

SIEM

EDR/XDR

Investigation

Tools

Forensic tools

Job description

We’re currently looking for an experienced Incident Response Analyst to join our client’s growing Cyber Security function, supporting the detection, investigation and resolution of cyber security incidents across a complex enterprise environment.
This is an excellent opportunity for a security professional with strong incident response, threat hunting and investigation experience who enjoys working across the full incident lifecycle while engaging with both technical and business stakeholders.

Location: London (2 days per week onsite, remainder remote)

Duration: 5 Months Initially

Rate: Competitive

IR35: Outside IR35

Start Date: ASAP

Duties and Responsibilities:

Incident Detection, Triage and Response:

• Monitor and analyse alerts from SIEM, EDR/XDR, identity, email, cloud, network and other security controls to identify suspicious or malicious activity.
• Triage alerts, validate incidents, determine severity and business impact, and escalate in line with the incident response process and defined service levels.
• Lead or support investigations into internal and external threats, including phishing, malware, account compromise, data loss, unauthorised access and suspicious network activity.
• Coordinate containment, eradication and recovery activities with infrastructure, application, identity, cloud and business teams, maintaining clear ownership and decision records.
• Maintain accurate incident case records, investigation timelines, evidence, actions, decisions and closure rationale from initial detection through to resolution.
• Provide timely incident updates and concise technical and management reports, including material facts, impact, risk, actions, dependencies and next steps.

Digital Forensics and Investigation:

• Collect, preserve and analyse endpoint, server, identity, network, email and cloud artefacts in accordance with approved forensic and evidence-handling procedures.
• Perform host and network analysis using logs, packet captures, forensic images and security telemetry to establish scope, root cause, attacker activity and affected assets.
• Identify indicators of compromise, tactics, techniques and procedures, and map findings to MITRE ATT&CK where appropriate.
• Support legally or regulatorily sensitive investigations by maintaining evidence integrity, chain of custody and appropriate access controls.
• Engage specialist internal or external forensic support where the complexity, scale or sensitivity of an incident requires additional expertise.

Threat Hunting and Detection Improvement:

• Develop and execute hypothesis-led threat hunts using threat intelligence, environmental knowledge and observed attacker behaviours.
• Create, tune and validate monitoring use cases, correlation rules, queries, custom indicators and detection content to improve coverage and reduce false positives.
• Assess detection gaps identified during incidents and recommend enhancements to logging, telemetry, processes and security controls.
• Contribute to purple-team, penetration-testing and control-validation activities and ensure relevant findings are converted into actionable detection or response improvements.

Incident Response Capability and Governance:

• Develop, maintain and exercise incident response plans, standard operating procedures, playbooks, call-out arrangements and stakeholder communication templates.
• Conduct post-incident reviews and root-cause analysis, track lessons learned and ensure agreed corrective actions are assigned and monitored to closure.
• Contribute to incident response metrics, key risk indicators, trend analysis and control-effectiveness reporting for management and governance forums.
• Support cyber exercises and simulations to validate roles, escalation paths, communications and decision-making under realistic incident conditions.
• Keep current with emerging threats, vulnerabilities, attack methods and changes to relevant industry frameworks and regulatory expectations.
• Practical experience in cyber incident response, security monitoring or a Security Operations Centre environment.
• Hands‑on experience investigating security alerts and incidents using SIEM and EDR/XDR technologies.
• Experience analysing Windows and Linux host artefacts, authentication activity, security logs, network traffic and packet captures.
• Working knowledge of incident response lifecycle activities including preparation, detection, analysis, containment, eradication, recovery and lessons learned.
• Experience producing incident records, investigation reports, management updates and post‑incident findings.
• Understanding of attacker behaviours and frameworks including MITRE ATT&CK, Cyber Kill Chain and NIST incident response guidance.
• Knowledge of enterprise networking, identity and access management, cloud services, email security, endpoint security, vulnerability management and data loss prevention.
• Ability to manage multiple priorities, exercise sound judgement under pressure and communicate clearly with technical and senior stakeholders.
• Awareness of evidence handling, forensic integrity, confidentiality and regulatory considerations relevant to cyber investigations.