Proactive Security Analyst: Breach & Attack Simulation

AXA UK; Greater London; Hybrid; GBP 70,000 - 95,000; Full time

Job summary

AXA UK is seeking a Security Analyst to join the Proactive Security team, focusing on Breach and Attack Simulation (BAS) tooling and continuous defence testing. You'll operate within AXA UK's Cyber Security function, in regulated environments, using leading frameworks and industry-standard tooling.

You will work with experienced security professionals, translating complex findings for senior stakeholders while building deep skills across security domains and real-world attacker techniques.

Qualifications

• Hands-on penetration testing experience across internal, external, web app and cloud
• Deep understanding of IT systems and vulnerabilities in cloud environments (AWS, Azure, GCP)
• Security testing framework experience (CREST, CBEST, TIGER) advantageous
• OSCP or MSc in Cyber Security desirable but not essential

Responsibilities

• Review threat intel feeds and testing findings to prioritise BAS use cases
• Support penetration testing engagements and ensure scope and reports meet AXA standards
• Review remediation plans from testing and verify fixes with BAS tooling
• React to BAS control test failures, investigate root causes and raise remediation requests
• Produce clear metrics and reports for executive steering groups
• Continuously look for ways to sharpen and scale security processes

Skills

Penetration testing

Cloud security

Threat modelling

Security frameworks

Vulnerability assessment

MITRE ATT&CK

CREST/CBEST

Education

MSc in Cyber Security

OSCP

Bachelor's in IT / related

Tools

BAS tooling

Job description

AXA UK is seeking a Security Analyst to join the Proactive Security team, focusing on Breach and Attack Simulation (BAS) tooling and continuous defence testing. You'll operate within AXA UK's Cyber Security function, in regulated environments, using leading frameworks and industry-standard tooling.

You will work with experienced security professionals, translating complex findings for senior stakeholders while building deep skills across security domains and real-world attacker techniques.