Principal Attack Monitoring Analyst (GSOC)

London Stock Exchange Group; Singapore; On-site; SGD 120,000 - 240,000; Full time

Benefits offered by this job

Healthcare

Retirement planning

Paid volunteering days

Wellbeing initiatives

Job summary

LSEG is a leading global financial markets infrastructure provider seeking a senior member of the Attack Monitoring team. You will provide technical leadership for investigations, support analyst development, and identify opportunities to enhance detection and response capabilities.

You will work closely with Incident Response teams, ensuring significant incidents are escalated appropriately while maintaining ownership of technical investigation activities within Attack Monitoring.

Qualifications

• Significant experience in a SOC, threat detection and monitoring, incident response or related cyber security function.
• Proven end-to-end investigations across a broad range of security alerts.
• Experience coaching and developing technical teams.
• Strong knowledge of TTPs and modern security operations practices.
• Experience with scripting or programming languages.

Responsibilities

• Act as the primary technical escalation point for security alerts.
• Lead complex investigations and provide hands-on analysis.
• Serve as senior SME for Attack Monitoring analysts.
• Coach and develop analysts to strengthen investigative capabilities.
• Assess incidents to determine escalation to Incident Response.
• Review alert volumes and outcomes to improve detection and reduce false positives.
• Partner with stakeholders to improve detection, monitoring and response processes.
• Identify opportunities to improve workflows through automation.
• Develop and maintain investigation playbooks and knowledge articles.
• Contribute to ongoing improvements of Security Operations capabilities.

Skills

SOC experience

Threat detection

Incident response

Mentoring

Automation

Scripting

Tools

Python

PowerShell

Bash

Job description

LSEG Security Operations is a central function that leverages people, processes, and technology to continuously monitor, detect, investigate, and respond to cyber security threats and incidents. Security Operations spans multiple disciplines, including Cyber Threat Intelligence, Security Analytics & Automation, Data Loss Prevention, Attack Monitoring and Cyber Incident Response. This role plays a critical part in protecting the Group from cyber threats that may impact business operations. As a senior member of the Attack Monitoring team, you will provide technical leadership for investigations, support analyst development, and identify opportunities to enhance detection and response capabilities. You will work closely with Incident Response teams, ensuring significant incidents are escalated appropriately while maintaining ownership of technical investigation activities within Attack Monitoring.

Responsibilities

• Act as the primary technical escalation point for cyber security alerts managed by the Attack Monitoring team.
• Lead complex investigations and provide hands‑on technical analysis across a broad range of cyber security events and alerts.
• Serve as a senior technical leader and subject matter expert for Attack Monitoring analysts.
• Coach, mentor, and develop analysts, helping to strengthen the team's investigative capabilities and technical expertise.
• Assess incidents and investigations to determine when escalation to Incident Response is required, working closely with Incident Response teams to ensure effective handover and collaboration.
• Review alert volumes, trends, and investigation outcomes to identify opportunities to improve detection fidelity, reduce false positives, and enhance operational effectiveness.
• Partner with stakeholders across Security Operations to recommend and drive improvements to detection, monitoring, triage, and response processes.
• Identify opportunities to improve analyst workflows through automation and process optimisation, supporting implementation teams where appropriate.
• Develop and maintain investigation playbooks, alert guides, and knowledge articles informed by incident learnings, threat intelligence, and emerging attack techniques.
• Contribute to the continual improvement of Security Operations capabilities, processes, and procedures through innovation and technical expertise.

Experience

• Significant experience within a Security Operations Centre (SOC), Threat Detection and Monitoring, Incident Response, Digital Forensics, or a related cyber security function.
• Proven experience conducting end‑to‑end investigations across a wide range of cyber security alerts.
• Demonstrated experience coaching, mentoring, and developing technical teams.
• Track record of identifying and implementing operational improvements through innovation, automation, and subject matter expertise.
• Deep understanding of modern cyber adversary tactics, techniques, and procedures (TTPs).
• Advanced knowledge of operating systems including Windows, Linux, Unix, and macOS, as well as their associated artefacts and file systems.
• Experience investigating activity across enterprise environments, including endpoint, network, identity, and cloud‑based technologies.
• Knowledge of public cloud platforms and services, including AWS, Azure, GCP, and Microsoft 365.
• Experience performing log analysis across multiple technology domains, including operating systems, network infrastructure, cloud platforms, and security tooling.
• Strong knowledge of Security Operations Centre practices, processes, and operating models.
• Strong understanding of incident response methodologies and frameworks, including NIST, SANS, or equivalent.
• Excellent written and verbal communication skills, with the ability to communicate technical concepts to both technical and non‑technical audiences.
• Preferred Experience within global financial services and/or highly regulated environments.
• Industry‑recognised certifications in Incident Response, Digital Forensics, Threat Detection, or Security Operations (e.g. GIAC, SANS, CREST, GCFA, GCIH, GNFA, or equivalent).
• Experience with scripting or programming languages.
• Proven ability to remain calm, decisive, and effective while managing high‑pressure situations and security incidents.
• Strong understanding of business risk and the ability to balance security requirements with operational objectives.
• Experience with security automation and orchestration technologies.

Career Stage: Manager London Stock Exchange Group (LSEG)

Information: Join us and be part of a team that values innovation, quality, and continuous improvement. If you're ready to take your career to the next level and make a significant impact, we'd love to hear from you.

LSEG is a leading global financial markets infrastructure and data provider. Our purpose is driving financial stability, empowering economies and enabling customers to create sustainable growth. Our purpose is the foundation on which our culture is built. Our values of Integrity, Partnership, Excellence and Change underpin our purpose and set the standard for everything we do, every day. They go to the heart of who we are and guide our decision making and everyday actions. Working with us means that you will be part of a dynamic organisation of 25,000 people across 65 countries. However, we will value your individuality and enable you to bring your true self to work so you can help enrich our diverse workforce. We are proud to be an equal opportunities employer.

This means that we do not discriminate on the basis of anyone’s race, religion, colour, national origin, gender, sexual orientation, gender identity, gender expression, age, marital status, veteran status, pregnancy or disability, or any other basis protected under applicable law.

Conforming with applicable law, we can reasonably accommodate applicants' and employees' religious practices and beliefs, as well as mental health or physical disability needs.

We are committed to sustainability across our global business and we are proud to partner with our customers to help them meet their sustainability objectives.

Our charity, the LSEG Foundation provides charitable grants to community groups that help people access economic opportunities and build a secure future with financial independence. Colleagues can get involved through fundraising and volunteering.

LSEG offers a range of tailored benefits and support, including healthcare, retirement planning, paid volunteering days and wellbeing initiatives.

• Healthcare
• Retirement planning
• Paid volunteering days
• Wellbeing initiatives

Please take a moment to read this privacy notice carefully, as it describes what personal information London Stock Exchange Group (LSEG) (we) may hold about you, what it’s used for, and how it’s obtained, your rights and how to contact us as a data subject. If you are submitting as a Recruitment Agency Partner, it is essential and your responsibility to ensure that candidates applying to LSEG are aware of this privacy notice.

LSEG (London Stock Exchange Group) is a leading global financial markets infrastructure and data provider. Our culture of connecting, creating opportunity and delivering excellence shapes how we think, how we do things and how we help our people fulfil our potential. Our Data & Analytics, Capital Markets and Post Trade divisions have a combined power that provides a comprehensive, integrated suite of trusted financial market infrastructure services to help our customers pursue their ambitions. Explore our divisions LSEG is headquartered in the United Kingdom, with significant operations in 70 countries across Europe, the Middle East, Africa, North America, Latin America and Asia Pacific. Find out more Get to know some of our people who are pushing the boundaries of technology, finance and more around the world.