Senior Cyber Security Analyst

Lightsource; Greater London; On-site; GBP 70,000 - 110,000; Full time

Job summary

Lightsource bp is seeking a Senior Cybersecurity Analyst to monitor cyber risk, lead remediation of vulnerabilities, and respond to incidents across its global IT systems.

You will work with Defender XDR and Sentinel, investigate threats, and collaborate with Infrastructure and Support teams to improve security maturity and drive risk reduction. This is a global, hands‑on role demanding strong communication skills.

Qualifications

• Bachelor's degree in Computer Science, Information Security, or related field.
• Industry-recognized security certifications (AZ-500, CISSP, CCP, Security+ etc.).
• 5+ years in cybersecurity with SOC/IR exposure.

Responsibilities

• Monitor security systems using SIEM/EDR to detect and investigate incidents to completion.
• Threat hunting using MITRE ATT&CK and Cyber Kill Chain frameworks.
• Enhance Defender technologies and other security solutions to counter risks.

Skills

Threat detection

Incident response

Threat hunting

Defender XDR

Azure cloud

KQL queries

Education

Bachelor's in CS or related

Azure Security Engineer AZ-500

CISSP

Tools

Microsoft Defender XDR

Microsoft Sentinel

Defender for Endpoint

Azure AD/Entra ID

Tenable/Nessus

Job description

About Lightsource bp

Lightsource bp is a global renewable energy company focused on onshore solar development and large‑scale energy storage solutions.

What you’ll do (the role)

Summary: We are seeking a dynamic, hands‑on Senior Cybersecurity Analyst to monitor cyber risk and lead the remediation of identified vulnerabilities across Lightsource bp’s IT systems globally. You will be responsible for threat detection, investigation, and incident response, leveraging a modern security technology stack with a strong focus on the Microsoft Defender ecosystem. Working across multiple business areas and time zones, you will proactively hunt for security issues, assess emerging threats, and partner with infrastructure and support teams to strengthen our security posture and drive business cyber maturity.

Responsibilities

• Continuously monitor the organization’s security systems and infrastructure using SIEM, EDR, and related toolsets to detect signs of compromise and investigate security events to completion.
• Proactively conduct threat hunting using threat intelligence frameworks (MITRE ATT&CK, Cyber Kill Chain) and available security platforms to identify and mitigate emerging threats.
• Assess new and evolving cyber threats to the business, optimizing existing Microsoft Defender technologies and other security solutions to better counter identified risks.
• Identify vulnerabilities in systems and applications; collaborate with Infrastructure, Digital Workplace, and Support teams to prioritize, patch, and remediate issues in a timely manner.
• Manage core Security Operations (SecOps) tooling platforms, ensuring correct configuration, maximizing security value from existing investments, and maintaining high‑quality configuration documentation.
• Communicate proactively with stakeholders across the business, providing clear technical and non‑technical updates during investigations and escalations.
• Support the development, enforcement, and continuous improvement of cloud security policies, standards, and procedures in alignment with industry frameworks (NIST 2.0, CIS, NIS2) and regulations.
• Create and maintain security awareness training content and assist in its delivery to colleagues across the organization.

Experience

• 5+ years of professional experience in cybersecurity, with at least 2+ years in a Security Operations Center (SOC) or incident response role.
• Advanced proficiency with Microsoft Defender XDR and expert‑level knowledge of Microsoft Sentinel, including KQL query writing and analytics rule development.
• Strong hands‑on experience with Microsoft Defender for Endpoint, including policy configuration and threat investigation.
• Demonstrable experience responding to cyber threats and working in an Azure‑focused cloud environment.
• Proven experience with the Cyber Kill Chain, MITRE ATT&CK, and other security defence and intelligence frameworks.
• Experience in stakeholder management and engagement at C‑Suite level.
• Experience working for Critical National Infrastructure (CNI) organizations is desirable.

Knowledge

• Microsoft Security Stack: Defender XDR/Sentinel, Defender for Cloud, Defender for Cloud Apps, Defender EASM, Copilot for Security.
• Vulnerability Management: Defender XDR, Tenable IO/Nessus, Defender EASM.
• Data Governance & IDAM: Microsoft Purview (DLP and information governance), Entra ID, Conditional Access Policies.
• Device Management: Working understanding of Intune (MDM/MAM).
• Networking/Firewalls: Exposure to Cisco Meraki and Fortinet FortiGate (desirable).
• Regulatory & Compliance Frameworks: NIST 2.0 Cyber Security Framework (required); NIS2, NERC CIP, SOC2, and IEC 62443 OT standards (desirable).
• ITIL Principles: Good understanding of ITIL principles and their application to IT service management.
• Information Security Technologies: Firewalls, intrusion detection systems, vulnerability assessment tools, logging solutions, gateway and endpoint security products, and authentication mechanisms.
• Operational Technology (OT) Cyber Security: Desirable but not required.

Skills

• Advanced threat detection, investigation, and incident response capabilities.
• Strong technical troubleshooting and problem‑solving skills with ability to work across complex, global technology environments.
• Expert‑level proficiency with Microsoft security tools and cloud‑based security architectures.
• Excellent communication skills: ability to translate complex technical concepts for both technical and non‑technical audiences.
• Proactive mindset with genuine enthusiasm for cybersecurity and drive to improve security posture.
• Ability to remain calm under pressure and manage multiple incidents and priorities.
• Cross‑functional collaboration: ability to partner effectively with Infrastructure, Digital Workplace, Support, and business teams worldwide.
• Strong documentation and reporting skills for both technical and executive audiences.
• Subject‑matter expertise with proven ability to identify and champion security improvement opportunities.

Education

• Bachelor’s degree in Computer Science, Information Security, Cybersecurity, or a related field.
• Industry‑recognized certifications (choose one or more): Azure Security Engineer (AZ‑500), Certified Information Systems Security Professional (CISSP), Certified Cyber Professional (CCP), CompTIA Security+, GIAC Certified Incident Handler (GCIH), GIAC Certified Intrusion Analyst (GCIA).

Additional Notes / Role‑Specific Requirements

• This is a global role supporting an expanding, geographically dispersed workforce and technology stack.
• You will interface regularly with multiple business areas across different time zones.
• You will work within a small, talented cybersecurity team and collaborate with a global IT organization.
• The role requires engagement with the convergence of IT and Operational Technology (OT) security, reflecting the evolving landscape of energy infrastructure protection.
• International regulatory compliance knowledge will be increasingly important as the organisation scales across multiple jurisdictions.