Overview
The Incident Response Analyst will join a specialized team within the Cyber Security function, focusing on detecting, investigating, and responding to cyber security incidents in a complex enterprise environment. This role involves collaborating closely with other analysts to enhance security measures and respond effectively to incidents, while engaging with both technical and non-technical stakeholders to communicate findings and strategies.
Responsibilities
- Investigate and respond to security incidents across endpoints, cloud, identity, and network environments.
- Analyse alerts from SIEM and EDR/XDR platforms to determine severity and business impact.
- Lead or support containment, eradication, and recovery activities.
- Conduct threat hunting and forensic investigations to identify attacker activity and root cause.
- Develop detection use cases and improve monitoring capabilities.
- Contribute to the creation and refinement of incident response playbooks.
Requirements
- Proven experience within Incident Response, SOC, or Cyber Security Operations.
- Hands-on experience and advanced knowledge of the Microsoft security stack, including SIEM and EDR/XDR technologies.
- Strong understanding of Windows/Linux investigations and network analysis.
- Familiarity with cyber threat frameworks such as MITRE ATT&CK.
- Ability to communicate effectively with both technical and non-technical stakeholders.
- Experience within a regulated environment is advantageous.