Experienced Security Operations Analyst
Job Description
[Up to c. $160k Base Salary + Discretionary Bonus | Hybrid Working - 4 Days in Office]
Role Overview
We’re representing an established financial-markets technology business whose platforms support institutional trading organisations globally. Its cyber security function is expanding its US capability and is looking for an experienced Security Operations practitioner to strengthen both day-to-day cyber defence and the organisation’s vulnerability-management programme.
This is a senior individual-contributor position rather than a people-management role. The successful hire will handle complex investigations and security incidents while taking meaningful ownership of vulnerability identification, prioritisation and remediation across a broad enterprise technology estate. You will work closely with security, infrastructure and engineering teams rather than operating as an isolated monitoring function. The strongest candidates will combine mature SOC and incident-response judgement with genuine vulnerability-management depth - particularly the ability to turn scanner findings and emerging CVEs into risk-based remediation decisions. There is also scope to improve detection quality, contribute to threat hunting and purple-team activity, and help mature how the wider Security Operations function operates...
Role Snapshot
- Bring 5+ years of hands-on experience across Security Operations, SOC, Incident Response or closely related cyber defence work, with the ability to operate independently as a senior practitioner; CISSP is required
- Own meaningful elements of the vulnerability-management lifecycle using platforms such as Tenable, Rapid7 or Qualys, including scanning, exposure analysis, prioritisation and remediation tracking
- Assess vulnerabilities using technical severity, exploit activity, threat intelligence and asset criticality rather than relying solely on scanner or CVSS output
- Take complex security incidents from initial validation through containment, eradication, recovery, root-cause analysis and clear post-incident reporting
- Work extensively with SIEM and endpoint-security technologies such as Splunk, Microsoft Sentinel, Sumo Logic, CrowdStrike Falcon or Microsoft Defender, correlating activity across endpoint, network, identity, cloud and SaaS telemetry
- Improve monitoring quality through detection-rule development, query creation, alert tuning and MITRE ATT&CK-informed analysis, with exposure to threat hunting or purple-team findings particularly useful
- Bring practical understanding of Windows and identity security, including Entra Conditional Access, Purview DLP, enterprise authentication and security logging
- Demonstrate strong network-security fundamentals across TCP/IP, DNS, HTTP/S, firewalls and proxies, with the ability to use this knowledge during investigations
- Use Python, PowerShell or Bash to support investigations, repeatable analysis or operational automation, while communicating incident and vulnerability findings clearly to technical and non-technical stakeholders
- (Preferred) Experience with SOAR, cloud-security telemetry, threat-intelligence platforms, digital forensics, adversary emulation or additional incident-response and detection-focused certifications
...
Apply for this role
All fields marked with * are required.