Security Analyst

The Security Analyst is responsible for monitoring, triaging and actioning alerts from our bespoke SIEM solution, assisting with incident response and digital forensics, and supporting client investigations. The role also includes leading self-directed projects that develop the analyst’s expertise and strengthen the capability of the team.

The position is fully remote, with occasional company-wide town hall meetings held in the UK.

Email review and initial triage

Review client emails through the Threat Spike email gateway to identify phishing and scams. Act as first responder for incidents, performing initial triage and analysis. Advanced analysis, client tickets and DFIRConduct in-depth analysis of high severity incidents and respond to client queries and tickets, ranging from routine email blocking requests to complex investigations. Digital forensics and incident response: support incident response operations, from reviewing SIEM logs and drawing detailed, accurate conclusions to leading client communications.

Analysts are expected to be self-starters. Alongside SOC duties, each analyst identifies opportunities, takes ownership of individual projects and sees them through to delivery.

Projects may span the full breadth of cyber security and are shaped by individual expertise and the needs of the team and our clients. Analysts have the autonomy to choose their focus, with the support required to deliver it.

• Threat intelligence Analyse cyber security news and gather intelligence through observed activity and independent research.
• Security engineering Work with our development team to improve heuristics and detections.
• Threat hunting Proactively search client environments for threats using data collected by the platform.
• Training Develop learning material and upskill the team on new techniques and tooling.
• Research and development Prototype new tools, automations and approaches that improve how the SOC works.
• Documentation Produce knowledge base articles, playbooks and SOPs for the team.

These areas are indicative rather than exhaustive. Proposals that add value to the team are welcomed.

• Education:
  
  a 1st class degree in Computer Science, Cyber Security or another STEM subject.
• Hands-on experience: at least one year of experience in blue team operations or another cyber security focused role.
• Deep technical understanding: operating systems, networking, security protocols, scripting and cloud infrastructure.
• Problem solving: strong analytical and problem-solving ability.
• A self-starter: curiosity, a commitment to self-learning and the initiative to take ownership of work and drive projects forward independently.
• Drive and ambition: passion, determination and a commitment to continuous improvement.
• Flexibility: the ability to manage multiple projects and commitments while delivering consistent results.
• Communication: the confidence to take charge of situations and lead conversations with internal
  and external stakeholders

Within 3 months

Demonstrate proficiency in the Threat Spike Wire platform, navigating it efficiently to identify and analyse the security artefacts relevant to an incident.

Gain hands-on SOC experience and a thorough understanding of the detection, response and remediation performed by our security agent and team.

Develop familiarity with complex tickets, detailed investigations and incident response. Within 12 months

Handle complex and critical incidents and tickets with confidence, engaging the relevant contacts.

Lead and deliver self-directed projects, sharing outcomes with the team. Contribute to our knowledge base, documentation, detections and SOPs, and liaise with the team and clients to share information.

Provide guidance and support to junior team members

Threat Spike has been protecting a vast global customer base for over 8 years, using technology developed in-house, coupled with a world-class managed services team. In the last year, we have turned our attention to managed IT, an area many companies still struggle with due to low quality solutions and poor service from conventional IT provide

The Security Operations Centre is the heart of our Managed Security product. Monitored 24/7/365, we aim to provide robust and comprehensive protection enterprise-wide. As a rapidly growing SOC and business, we offer an environment in which analysts can…