A Day In The Life
Review, triage and investigate security alerts, events and incident tickets.
Analyse security logs to identify suspicious activity, assess potential impact and determine appropriate next steps.
Investigate common threats including phishing, malware and account compromise.
Follow established incident response playbooks, escalating incidents and requesting support when needed.
Maintain accurate investigation notes, ticket updates and incident documentation.
Work within defined response and resolution expectations for security tickets.
Collaborate with IT Services, Identity and Access Management, engineering, fraud and customer service teams.
Develop practical experience with security technologies including Splunk, SentinelOne, Netskope and AWS security services.
Participate in peer reviews and incident retrospectives, sharing lessons learned with colleagues.
- Support improvements to security processes and develop your understanding of vulnerability management, cloud security and security tooling.
- About You:
- You have practical experience in security operations or a relevant technical environment such as infrastructure, network, cloud operations or IT support, along with a blend of the following:
Understanding of cyber security fundamentals, including phishing, malware, account compromise, vulnerabilities, threats and risks.
Experience proactively reviewing and investigating security alerts or analysing logs to investigate unusual activity.
Knowledge of the incident response lifecycle and can follow documented procedures.
Foundational knowledge of Windows, macOS, Linux and core networking concepts.
Understand basic cloud concepts, particularly AWS services such as IAM, S3 and CloudTrail.
You approach investigations analytically, gathering evidence and assessing potential impact before deciding what to do next.
Communication is one of your strengths; you communicate clearly, document your findings accurately and know when to escalate.
You can prioritise security tickets, manage your time and work within agreed service levels.
- You're curious, eager to learn, comfortable asking for support and committed to working collaboratively.
- Added Bonus:
- Experience using SIEM, EDR or security tools such as Splunk, SentinelOne, Netskope, Mimecast, Tenable or AWS GuardDuty.
Basic scripting experience using Python, Bash or PowerShell.
Practical experience with phishing investigations or vulnerability management.
Familiarity with the MITRE ATT&CK framework.
Experience using Git or version control alongside engineering teams.
Experience working in financial services, fintech or another regulated environment.
Awareness of FCA requirements and UK GDPR.
Security certifications such as CompTIA Security+, CySA+ or CEH, or a relevant degree.
Experience safely using AI tools to support everyday work.
