Security Operations Analyst (SOC analyst)

Fairygodboss; Greater London; On-site; GBP 50,000 - 75,000; Full time

Job summary

JPMorganChase in London is hiring a hands-on Security Analyst for Detection and Response within the Cybersecurity Operations team. You will triage security alerts, investigate cases end-to-end, and contribute to threat hunting and detection engineering in a fast-paced environment.

The role follows a follow-the-sun model with weekday hours and rotational weekend shifts, requiring strong collaboration across global SOC and engineering teams.

Qualifications

• 2+ years in a SOC, incident response, or security analyst role.
• Strong monitoring and investigation skills across SIEM, EDR/XDR, and network tools.
• Working knowledge of MITRE ATT&CK framework and common attack techniques.
• Ability to analyze logs, reconstruct incident timelines, and communicate findings.

Responsibilities

• Triage and analyze security alerts from SIEM, EDR, and other tooling.
• Investigate incidents end-to-end from detection through containment and resolution.
• Proactive threat hunting across endpoints, networks, cloud, and identity telemetry.
• Develop, tune, and refine detection rules, use cases, and correlation logic.
• Leverage AI-assisted tooling to accelerate investigations and improve efficiency.
• Document findings, maintain case records, and produce incident reports.
• Collaborate with global SOC teams for seamless handoffs under follow-the-sun model.
• Contribute to SOC playbooks, runbooks, and standard operating procedures.
• Stay current with threat landscape and MITRE ATT&CK mappings.

Skills

SOC experience

Security monitoring

MITRE ATT&CK

Networking basics

Incident investigation

Threat hunting

Communication skills

Education

Bachelor's degree in CS/InfoSec

Industry certifications

Tools

Sigma

YARA

KQL

SPL

SOAR

Job description

About JPMorganChase and the Team

JPMorganChase is a global leader in financial services, serving millions of clients and many of the world's most prominent corporate, institutional, and government clients. Protecting the firm, its customers, and the integrity of the global financial system is a foundational priority, and the Cybersecurity Operations organization is central to that mission. Within it, the Detection and Response team serves as the front line of the firm's cyber defense, operating a global \"follow-the-sun\" model that delivers 24/7 monitoring, detection, and response across regions. The London SOC is a critical hub anchoring coverage across EMEA, working seamlessly with partner centers worldwide to ensure continuous, uninterrupted protection.

Role Overview

This is a hands-on detection and response role at the core of the firm's cyber defense operations. The analyst will primarily triage security alerts and investigate cases end-to-end, while contributing to threat hunting, detection engineering, and the adoption of AI-assisted tooling to improve investigative efficiency and accuracy. The position suits a technically strong practitioner who thrives in a fast-paced, high-stakes environment and is motivated by continuous improvement.

Working Model and Schedule

The team operates a follow-the-sun model to guarantee continuous global coverage. Analysts work standard weekday business hours, for the most part, with weekend shift coverage required on a rotational basis approximately once every five (5) weeks. This rotation ensures uninterrupted monitoring and response capability across all time zones and handoff points.

Key Responsibilities

• Triage and analyze security alerts from SIEM, EDR, and other detection tooling, prioritizing based on severity, risk, and business impact.
• Investigate security incidents and cases end-to-end, from initial detection through containment, eradication, and documented resolution.
• Conduct proactive threat hunting across endpoints, networks, cloud, and identity telemetry to identify undetected threats and emerging adversary behavior.
• Contribute to detection engineering: develop, tune, and refine detection rules, use cases, and correlation logic to reduce false positives and improve coverage.
• Leverage AI and automation tooling (e.g., AI-assisted triage, enrichment, and summarization) to accelerate investigations and improve analyst efficiency.
• Document findings, maintain accurate case records, and produce clear incident reports and post-incident reviews.
• Collaborate with global SOC teams, threat intelligence, incident response, and engineering functions to ensure seamless handoffs under the follow-the-sun model.
• Contribute to continuous improvement of SOC playbooks, runbooks, and standard operating procedures.
• Stay current with the evolving threat landscape, attacker TTPs (mapped to frameworks such as MITRE ATT&CK), and industry best practices.

Required Qualifications, Capabilities, and Skills

• Demonstrable experience in a SOC, incident response, or security analyst role (typically 2+ years).
• Solid understanding of security monitoring and investigation across SIEM, EDR/XDR, and network security tooling.
• Working knowledge of common attack techniques, the cyber kill chain, and the MITRE ATT&CK framework.
• Strong understanding of core networking concepts (TCP/IP, DNS, HTTP/S, proxies, firewalls) and operating system internals (Windows, Linux).
• Experience investigating alerts across endpoint, network, cloud, and identity/authentication logs.
• Ability to analyze logs, correlate events across multiple data sources, and reconstruct incident timelines.
• Strong written and verbal communication skills for clear documentation and stakeholder updates.
• Ability to work under pressure, prioritize effectively, and participate in weekend shift rotation (approximately once every five weeks).

Preferred Qualifications, Capabilities, and Skills

• Experience with detection engineering and writing/tuning detection content (e.g., Sigma, YARA, KQL, SPL, or equivalent).
• Hands-on threat hunting experience using hypothesis-driven methodologies.
• Familiarity with SOAR platforms, scripting/automation, and AI-assisted security tooling.
• Experience defending large, complex enterprise or financial-services environments.
• Exposure to cloud security monitoring (AWS, Azure, or GCP).
• Knowledge of threat intelligence concepts and integration into detection and response workflows.

Education and Certifications

• Bachelor's degree in Computer Science, Information Security, or a related field, or equivalent practical experience.
• Industry certifications are advantageous, such as: CompTIA Security+, CompTIA CySA+, GIAC (GCIH, GCIA, GCFA, GDAT), Blue Team Level 1/2 (BTL1/BTL2), CEH, or cloud security certifications (AWS/Azure/GCP security).

ABOUT US

J.P. Morgan is a global leader in financial services, providing strategic advice and products to the world's most prominent corporations, governments, wealthy individuals and institutional investors. Our first-class business in a first-class way approach to serving clients drives everything we do. We strive to build trusted, long-term partnerships to help our clients achieve their business objectives.

We recognize that our people are our strength and the diverse talents they bring to our global workforce are directly linked to our success. We are an equal opportunity employer and place a high value on diversity and inclusion at our company. We do not discriminate on the basis of any protected attribute, including race, religion, color, national origin, gender, sexual orientation, gender identity, gender expression, age, marital or veteran status, pregnancy or disability, or any other basis protected under applicable law. We also make reasonable accommodations for applicants' and employees' religious practices and beliefs, as well as mental health or physical disability needs. Visit our FAQs for more information about requesting an accommodation.

ABOUT THE TEAM

Our professionals in our Corporate Functions cover a diverse range of areas from finance and risk to human resources and marketing. Our corporate teams are an essential part of our company, ensuring that we're setting our businesses, clients, customers and employees up for success.