Information Security Analyst - Security Operations Centre

• Full-time

We believe in the power of ingenuity to build a positive human future.

As strategies, technologies, and innovation collide, we create opportunity from complexity.

Our teams of interdisciplinary experts combine innovative thinking and breakthrough technologies to progress further, faster. Our clients adapt and transform, and together we achieve enduring results.

We are over 4,000 strategists, innovators, designers, consultants, digital experts, scientists, engineers, and technologists. And we have deep expertise in consumer and manufacturing, defence and security, energy and utilities, financial services, government and public services, health and life sciences, and transport.

Our teams operate globally from offices across the UK, Ireland, US, Nordics, and Netherlands.

PA. Bringing Ingenuity to Life.

Hybrid working - our approach is to be in the office 2 - 3 days per week.

The purpose of this role is to be part of PA's Group Systems Security Operations Centre (SOC), helping protect PA by monitoring the technology estate, investigating and responding to security incidents, proactively hunting for threats, and continually improving security detections, controls and working practices.

Key Activities:

Monitor and investigate security alerts across SIEM, EDR/XDR, email security, cloud platforms, identity, network security and data loss prevention tooling.

Triage security events, determine scope and impact, coordinate containment and remediation, and maintain clear investigation records and evidence.

Perform proactive threat hunting using threat intelligence, attacker techniques and hypotheses relevant to PA.

Develop and tune detections, use cases, dashboards, playbooks and automation to improve coverage and reduce unnecessary alert volume.

Support digital forensic analysis, malware and phishing analysis, and post-incident reviews as required.

Analyse relevant threat intelligence, vulnerabilities and supplier advisories, assess PA exposure and recommend proportionate actions.

Support vulnerability and exposure management through reporting, prioritisation, tracking and engagement with asset owners. Remediation remains the responsibility of asset owners.

Carry out security checks requested by the business, including software, website and identity-related checks, and provide practical risk-based advice.

Contribute to security improvement projects, operational documentation, knowledge sharing, metrics and reporting.

Participate in the paid out-of-hours on-call rota and respond to high-severity incidents when required.

Essential skills and experience

Practical experience in a SOC, incident response, security monitoring, detection engineering or a closely related technical security role.

Strong investigation, log analysis and correlation skills across endpoint, identity, email, cloud and network telemetry.

Experience using SIEM and EDR/XDR platforms to investigate alerts and support containment and remediation.

Ability to document investigations clearly, maintain evidence and explain findings to technical and non-technical stakeholders.

Good understanding of common attacker techniques, phishing, account compromise, malware, vulnerabilities and cloud security risks.

Ability to prioritise effectively and collaborate across operational teams.

A careful, curious and evidence-led approach, with strong attention to detail and sound judgement.

Willingness to participate in the paid out-of-hours on-call rota.

Desirable skills and experience

Threat hunting, detection-rule development, alert tuning, malware analysis or digital forensics experience.

Knowledge of vulnerability and exposure management, penetration-testing remediation and security-control assurance.

Knowled…