Senior Security Analyst

The Senior Security Analyst role supports the Division of the Office of the CISO, with a focus on cyber incident response and vulnerability management. The position operates within a security operations environment, handling SOC alert triage, incident assessment, vulnerability scanning triage, and coordination of remediation activities across applications, infrastructure, and cloud.

• Perform alert triage for security alerts to validate, prioritize, and determine which incidents require follow-up.
• Assess incident severity, impact, and root cause using MSSP capabilities and internal tools.
• Monitor and respond to security alerts and events from tools including SIEM, IDS/IPS, firewalls, email, and endpoint detection and response (EDR), meeting defined SLAs.
• Conduct initial incident triage and assessment to confirm severity and impact.
• Carry out routine reviews of IAM to identify and address abuse of permissions by authorised users.
• Monitor for policy violations and report suspicious user behaviour.
• Assist with containment activities, including isolating affected systems under supervision.
• Maintain work notes and artifact logging in ITSM systems (Service Now / Confluence) for incident tickets.
• Complete shift handovers to other SOC team members to support continuity of ongoing incidents, including providing clear updates and escalation details.
• Seek guidance from, and elevate as needed to, Mid-level Tier 2 analysts.
• Support daily security operations by running regular vulnerability scans, analyzing reports, and triaging identified issues for timely risk mitigation.
• Lead end-to-end vulnerability remediation coordination across applications, infrastructure, and cloud environments, working closely with development and operations teams to implement sustainable security controls.
• Optimize vulnerability scanning profiles, dashboards, and reports to improve coverage, actionable insights, and remediation guidance.
• Contribute to continuous improvement of vulnerability management processes, policies, and procedures, including support for incident response activities and alignment with industry best practices.
• Stay current on evolving cyber security threats, vulnerabilities, and attack techniques.
• Participate in on-call rotations and provide triage and escalation support.
• Handle security inbox queries and ensure timely responses to security-related inquiries.
• Perform other duties as assigned.

• 2+ years in an Information Security role with proven experience in Security Operations or Threat Analysis.
• Hands-on experience with SIEM and EDR platforms.
• Analytical mindset with knowledge of TTPs, malware behaviour, and incident handling methodologies.
• Familiarity with IAM concepts and monitoring, including reviewing permissions, detecting abuse, and flagging suspicious behaviour or policy violations.
• Experience performing alert triage and incident escalation within defined SLAs, using ITSM tooling such as Service Now and documentation platforms such as Confluence.
• Strong collaboration skills working with application and infrastructure teams in a security context.
• In-depth knowledge of security best practices and frameworks (for example MITRE ATT&CK, OWASP Top 10, NIST).
• Excellent written and verbal communication skills, including the ability to produce work notes, handover reports, and stakeholder updates.
• Ability to manage multiple projects and tasks.
• Ability to capture and summarise information, solve tactical and strategic problems, and prioritize work.
• Exposure to public cloud infrastructure (SaaS, IaaS, and PaaS).

SIEM, IDS/IPS, firewalls, email, endpoint detection and response (EDR) systems, MSSP, ITSM (Service Now / Confluence), Service Now, Confluence, MITRE ATT&CK, OWASP Top 10, NIST, EDR, IAM, Python, Power Shell, KQL, SOAR, OpenCTI, Recorded Future, MISP, CompTIA Security+, CySA+, CEH, SANS, Cloud Certifications.

• 1+ years of experience within Incident Response and/or Security Operations.
• Scripting or automation experience (Python, Power Shell, KQL) to enhance SOC playbooks, enrich alerts, or reduce manual triage effort.
• Exposure to SOAR platforms and use-case development for automating repeatable response actions.
• Experience working alongside an MSSP or within a co-managed SOC model.
• Familiarity with threat intelligence platforms (OpenCTI, Recorded Future, MISP) and applying CTI to detection and hunting.
• Relevant Information Security certifications (for example CompTIA Security+, CySA+, CEH, SANS, Cloud…