Security Operations Analyst: Threat Hunter & Incident Response

G-Research; City of Westminster; On-site; GBP 65,000 - 85,000; Full time

Benefits offered by this job

Competitive compensation

Lunch via Just Eat for Business

35 days annual leave

9% company pension contributions

Healthcare and life assurance

Cycle-to-work scheme

Monthly company events

Barista bar

Job summary

G-Research in London seeks a Security Operations Analyst to join the Security Operations Centre (SOC). You will monitor, investigate and respond to security incidents across high-performance compute environments, hybrid cloud platforms and corporate estate.

You will analyse alerts, perform triage, support containment and contribute to improving detection capabilities while collaborating with engineers and the broader security function.

Qualifications

• Experience in a SOC/CSIRT or security operations role with hands-on alert handling and investigations
• Strong understanding of security fundamentals including network security and malware behaviours
• Experience using SIEM, XDR or SOAR tools such as Elastic Security, Sentinel, Azure Defender XDR or AWS Security Hub
• Ability to analyse logs, correlate events and develop investigative hypotheses
• Familiarity with forensic concepts including filesystems, memory artefacts and cloud control-plane events
• Strong written and verbal communication skills and collaboration with engineers
• Desirable scripting with Python or PowerShell

Responsibilities

• Perform triage, investigation and escalation of security alerts across HPC, cloud and corporate environments
• Support incident response activities including containment, remediation and reporting
• Conduct host and log-based forensic analysis across Windows, Linux, cloud, network and application environments
• Execute threat hunting tasks to identify abnormal or suspicious behaviours beyond existing detections
• Develop and refine detection rules, analytics and playbooks with senior analysts
• Maintain accurate investigation records and case documentation
• Contribute to workflow, tooling and operational process improvements
• Collaborate with colleagues, engineers and internal stakeholders to support investigations and knowledge sharing

Skills

SOC operations

alert handling

investigations

network security

endpoint artefacts

authentication patterns

malware behaviours

attack techniques

SIEM

XDR

SOAR

Python

PowerShell

cloud platforms

HPC environments

Education

Security certifications (e.g., GCIH, GCIA)

Tools

Elastic Security

Microsoft Sentinel

Azure Defender XDR

AWS Security Hub

Job description

G-Research in London seeks a Security Operations Analyst to join the Security Operations Centre (SOC). You will monitor, investigate and respond to security incidents across high-performance compute environments, hybrid cloud platforms and corporate estate.

You will analyse alerts, perform triage, support containment and contribute to improving detection capabilities while collaborating with engineers and the broader security function.