Incident Response Analyst – CSIRT & Forensics (Hybrid)

Airbus S.A.S.; Rookley; Hybrid; GBP 60,000 - 90,000; Full time

Job summary

Airbus Defence and Space is seeking an Incident Response Analyst to join our international CSIRT in Newport. You will manage the full lifecycle of security incidents, investigate SOC alerts, and contribute to the industrialisation of security tooling including SIEM and EDR.

The role emphasises automation, threat detection development, and robust incident response processes across our global operations, with on‑call responsibilities and a focus on secure, scalable security operations.

Qualifications

• Experience managing security incidents and monitoring SOC alerts in a technical SOC/CSIRT.
• Experience performing host forensic analysis and reverse‑engineering to support incident response.
• Experience designing and improving security processes, threat use cases, and automated responses.
• Degree or equivalent experience with industry certifications such as GIAC.

Responsibilities

• Investigate SOC alerts and manage the full lifecycle of security incidents.
• Support incident response in crisis mode as part of on‑call crisis team.
• Industrialise security tooling (SIEM, EDR) and develop new detection use cases.
• Design, implement, and coordinate robust incident response processes for SOC Level 1 and 2.
• Drive continuous improvement of threat detection and response capabilities.
• Execute projects related to advanced security monitoring and automated incident response.

Skills

Incident response

SOC alerts

Forensic analysis

Reverse engineering

Threat detection

Automated response

Security tooling

Process improvement

On-call management

Crisis management

Education

Relevant degree

GIAC certification

Tools

SIEM

EDR

Forensic tools

Job description

Airbus Defence and Space is seeking an Incident Response Analyst to join our international CSIRT in Newport. You will manage the full lifecycle of security incidents, investigate SOC alerts, and contribute to the industrialisation of security tooling including SIEM and EDR.

The role emphasises automation, threat detection development, and robust incident response processes across our global operations, with on‑call responsibilities and a focus on secure, scalable security operations.