Senior It Security Analyst, London

E1 Edf Trading Ltd; Greater London; Hybride; GBP 90 000 - 130 000; Plein temps

Résumé du poste

EDF Trading in London is seeking a senior security professional to act as a senior technical contributor within the global cyber security team, owning selected domains end-to-end and driving improvements to reduce risk. The role spans analyst and engineering tasks across tools, vulnerability management, web and email security, incident response, and threat-informed remediation.

You will collaborate with infrastructure, cloud, application, identity and business teams to identify issues,

Qualifications

• Operated as a senior technical contributor in cyber or infrastructure security.
• Owned or contributed to multiple cyber domains such as endpoint security or identity security.
• Used EDR tooling to investigate detections and improve controls.
• Applied threat intel and ATT&CK data to prioritise mitigations.
• Led investigations and incident response activities when required.
• Collaborated with cross-functional teams to improve security outcomes.

Responsabilités

• Own one or more cyber security domains end-to-end with risk and backlog management.
• Identify weaknesses and drive remediation with technical owners.
• Lead security improvement initiatives from design to implementation.
• Translate threat intel into practical control improvements with stakeholders.
• Maintain domain documentation, standards and improvement plans.
• Administer and tune security tools; design simple automations and dashboards.

Connaissances

Threat intelligence & MITRE ATT&CK

Incident response

Vulnerability management

Identity security

Security automation

Cloud security (Azure/M365)

Secure configuration & hardening

Scripting (PowerShell/Python)

Outils

CrowdStrike Falcon

Zscaler ZIA/ZPA

BloodHound Enterprise

PingCastle

Description du poste

Description

:

Department

Information Technology (IT)

Position purpose

To act as a senior technical contributor within EDF Trading’s global cyber security team, owning selected cyber security domains end-to-end and driving practical improvements to reduce cyber risk.

The role combines analyst and engineering responsibilities across security tools, vulnerability and exposure management, web and email security, incident response, and threat-informed remediation.

The role works closely with infrastructure, cloud, application, identity and business teams to identify security issues, prioritise actions based on real-world attacker behaviour, and deliver measurable improvements to EDF Trading’s cyber defence posture.

To support EDF Trading’s cloud security by advising on, reviewing and improving Microsoft Azure and 365 security controls.

Main responsibilities

• Own one or more cyber security domains end-to-end, ensuring risks, controls, tooling, remediation activity and improvement backlogs are understood and actively managed.
• Identify weaknesses, exposures and control gaps across assigned domains and drive resolution with the relevant technical owners.
• Lead security improvement initiatives from analysis and design to implementation, documentation and operational handover.
• Translate threat intelligence, MITRE ATT&CK techniques and observed attacker behaviours into practical control improvements.
• Maintain clear domain-level documentation, including risks, controls, technical standards, operational processes and improvement plans.
• Provide senior technical input into security roadmaps and control improvement activities.

• Administer, configure and continuously improve cyber security tools, including CrowdStrike, Zscaler ZIA/ZPA, and BeyondTrust Endpoint Privilege Management (EPM).
• Improve security tooling effectiveness by tuning configurations, reducing noise, improving visibility and increasing operational value.
• Design, build and deploy small tools, scripts, dashboards or automations to improve operations.
• Support integration of tooling into workflows, reporting and incident response processes.
• Maintain practical knowledge of Microsoft 365, Azure / Entra ID and Microsoft security controls, supporting improvements with the primary platform owners.
• Use automation and AI-enabled workflows responsibly to accelerate analysis, documentation, query development and repetitive operational tasks.

• Support vulnerability management by analysing weaknesses, validating risk, prioritising remediation and tracking material issues to closure.
• Apply threat intelligence, exploitation evidence, asset criticality and business context to prioritise remediation activity.
• Identify and manage exposure risks across endpoints, identity, SaaS, remote access and cloud-adjacent environments.
• Support attack path reduction activity across Active Directory, Entra ID and privileged access pathways.
• Use tools such as PingCastle and BloodHound Enterprise to identify identity-related weaknesses and drive remediation with infrastructure and identity teams.
• Advise technical teams on secure configuration and hardening improvements, including Active Directory, GPO, Microsoft 365, Azure Policy and identity controls.

• Lead or support investigations into alerts, suspicious activity, phishing, endpoint events, identity anomalies and other cyber security incidents.
• Coordinate with the MDR provider, IT teams and system owners to validate detections, contain threats and complete remediation actions.
• Contribute to incident response playbooks, detection improvements, tabletop exercises and operational readiness activities.

• Represent cyber security in technical discussions, project forums and governance meetings.
• Work closely with infrastructure, cloud, application, identity, service desk, compliance and business stakeholders to resolve security risks.
• Communicate risks, remediation options and recommended actions clearly to technical and non-technical stakeholders.

Experience required

The successful candidate can demonstrate that they have:

• Operated as a senior technical contributor in cyber or infrastructure security.
• Owned or materially contributed to one or more cyber security domains, such as endpoint security, vulnerability management, identity security, network security, incident response or Microsoft 365 / Azure security.
• Used CrowdStrike or equivalent EDR tooling to investigate detections, support incident response and improve endpoint security controls.
• Used Zscaler ZIA/ZPA or equivalent secure web gateway, private access, zero trust or network access security technologies.
• Performed vulnerability assessment, exposure analysis or remediation prioritisation across enterprise technology environments.
• Applied threat intelligence, MITRE ATT&CK or exploitation-based evidence to prioritise mitigations.
• Supported or led cyber security investigations and incident response activities.
• Collaborated with infrastructure, cloud, application, identity and business teams to deliver security improvements.
• Used scripting, queries, automation or data analysis to improve security outcomes.

Technical requirements

• Strong hands-on experience administering, tuning and operationalising CrowdStrike Falcon, including endpoint protection, EDR investigations, detection analysis and response workflows.
• Strong hands-on experience administering and supporting Zscaler ZIA and ZPA, including policy design, access control, traffic analysis and security troubleshooting.
• Practical experience leading or supporting vulnerability and exposure management programmes, including vulnerability analysis, risk-based prioritisation, remediation tracking and validation of control effectiveness.
• Strong knowledge of real-world attacker tactics, techniques and procedures (TTPs) and the ability to translate threat intelligence, attack paths and exploitation trends into actionable security improvements.
• Experience conducting security investigations and incident response activities, including alert triage, root cause analysis, containment, remediation and lessons learned.
• Identity Security
• Active Directory and Group Policy security and hardening
• Entra ID security
• Conditional Access
• MFA design and implementation
• Identity governance
• Single Sign-On
• Attack Path Management
• PingCastle
• BloodHound Enterprise
• Attack path analysis and reduction
• Microsoft Security Technologies
• Microsoft Defender
• Microsoft Sentinel
• Microsoft Defender for Cloud Apps
• Microsoft 365 security controls
• Azure Policy
• Detection, Hunting & Automation
• Threat hunting
• Custom detections and security queries
• PowerShell or Python scripting
• Security automation and SOAR
• Certifications
• OSCP
• GCIH
• CISSP
• CISM
• SC-200
• SC-300
• AZ-500

Person specification

• Strong security mindset, with curiosity about how attacks work and how controls fail.
• Outcome-focused and accountable, with strong attention to accuracy and detail.
• Proactive, tenacious and comfortable solving ambiguous technical problems.
• Able to work independently while knowing when to elevate material risk or uncertainty.
• Comfortable balancing tactical operational demands with longer-term control improvement.
• Confident communicator who can explain technical issues clearly to different audiences.
• Collaborative and credible with infrastructure, cloud, application, identity and business stakeholders.
• Willing to mentor others and raise the technical capability of the team.
• Comfortable operating in a fast-paced trading environment with competing priorities.

Hours of work:

Core hours of 8.30am – 5.30pm; however, flexibility is required to meet essential business deadlines.

Hybrid working, with a minimum of 3 days in our London office.