Read more

Experis Austria; Preston; On-site; GBP 42,000 - 62,000; Full time

Job summary

Experis Austria is seeking a Security Incident Management Analyst to join our governance team in a multi-supplier environment. The role focuses on ensuring incidents are tracked, reported, and evidenced without doing hands-on SOC work.

You will coordinate with suppliers, maintain incident records, generate dashboards, and support assurance activities, with emphasis on process compliance and audit readiness.

Qualifications

• Experience in cyber security, service management or governance.
• Understanding of security incident management processes.
• Exposure to SIAM or multi-supplier environments.
• Awareness of incident classifications and major incidents.
• Ability to coordinate stakeholders and produce reports.

Responsibilities

• Support monitoring of incidents throughout their lifecycle.
• Maintain incident records and supplier updates.
• Track progress from identification to closure.
• Coordinate with suppliers for updates and reports.
• Assist governance forums with reporting.

Skills

Cyber security

Service management

Governance

Incident management

ITIL

SIAM environments

Stakeholder coordination

Governance reporting

Tools

Incident tooling

Job description

Location: Inverness or Preston | 5 days onsite

Clearance: Active SC clearance / UK sole national

Role Description:

The Security Incident Management Analyst operates within the Operational Integrator (OI) function in a multi-supplier (SIAM) environment, supporting the governance and coordination of security incident management activities across suppliers.

This is a governance and coordination role and does not perform Security Operations Centre (SOC) monitoring, threat hunting, incident response, or technical remediation activities.

If you are successfully offered this position, you will go through a series of pre-employment checks, including identity, nationality (single or dual) or immigration status, employment history going back 3 continuous years, and unspent criminal record check (known as Disclosure and Barring Service)

Key Responsibilities:

• Support the monitoring of security incidents throughout their lifecycle
• Ensure incident records are maintained and updated by suppliers
• Track incident progress from identification through to closure
• Escalate overdue, recurring, or high-impact incidents through agreed governance channels
• Coordinate with suppliers to obtain incident updates and status reports
• Support the collection and validation of supplier incident reporting
• Ensure incident data standards and reporting requirements are applied consistently
• Identify gaps in ownership, reporting, or evidence
• Produce routine security incident reports and dashboards
• Assist in monitoring:
• SLA compliance
• Escalation trends
• Support governance forums through accurate reporting and status updates

Governance & Process Compliance

• Support adherence to agreed incident management processes
• Ensure supplier activities align with client security policies and standards
• Assist with documenting lessons learned and improvement actions
• Support maintenance of incident governance documentation

Assurance & Evidence Support

• Collect and organise incident management evidence
• Support assurance and audit activities
• Ensure incident records remain complete, traceable, and audit-ready
• Assist in demonstrating process compliance and effectiveness

Your skills and experience

• Experience in cyber security, service management, operational governance, or support roles
• Understanding of security incident management processes
• Awareness of:
• Incident severity classifications
• Major incident management principles
• Strong organisational and reporting skills
• Ability to coordinate multiple stakeholders
• Exposure to SIAM or multi-supplier environments
• Familiarity with incident management tooling and reporting outputs
• Understanding of ITIL Incident Management concepts
• Experience in regulated, government, or defence environments
• Supplier incident performance metrics
• Incident status tracking and governance records
• Audit-ready incident evidence
• Inputs to governance and operational review forums

Role Definition

The role supports the governance and visibility of security incident management activities across suppliers, ensuring incidents are consistently tracked, reported, and evidenced without performing operational incident response activities.

What This Role Does / Does Not Do

Does

• Track and coordinate incidents
• Support governance and reporting activities
• Maintain incident visibility and status reporting

Does Not

• Operate SOC tooling
• Perform threat hunting
• Own technical remediation activities