Cyber Security Analyst | ED&F Man

Cyber Security Analyst | ED&F Man | London, UK

We are looking for a Cyber Security Analyst to join our global security team. This role will suit a technically capable individual with experience in security operations who is looking to broaden their exposure across security monitoring, engineering, and incident response within a dynamic environment.

The role provides hands‑on involvement in triaging and investigating security alerts, acting as an escalation point for the outsourced Security Operations Centre (SOC), supporting major incident response activities. The successful candidate will work closely with infrastructure and network teams to manage and optimise endpoint, email, identity, and vulnerability management platforms, while contributing to continuous improvement of the organisation’s security posture.

This role offers the opportunity to evaluate and transition between security tools, maintain policy continuity and develop a broad, practical skillset across enterprise cyber security functions.

Established in 1783, ED&F Man is an employee‑owned agricultural commodities merchant with 2,800 people in 43 countries and annual revenue in excess of $8bn. We trade sugar, coffee, molasses, animal feed and fish oils. Corporate responsibility is ingrained in our culture. We are passionate about sustainable production, take care to limit the environmental impact of our operations and actively support the communities in which we work.

• Act as the escalation point for the outsourced SOC, receiving and triaging alerts that require deeper investigation.
• Conduct thorough investigations to produce high‑quality, actionable insights for incident resolution.
• Participate actively in major security incidents, contributing to containment, eradication and recovery efforts.
• Document incident timelines and contribute to post‑incident reviews and lessons learned.
• Respond to detections, triage alerts and update SOC tickets with investigation findings.
• Maintain and update policies in line with vendor best practice and internal Change Advisory Board protocols.
• Monitor agent health, audit version compliance and remediate orphaned or non‑compliant clients.
• Attend monthly vendor meetings to review support cases and incorporate best practice guidance.
• Design and refine SOC playbooks and response actions, evaluating new security technologies through structured proof‑of‑concept trials and creating scoring matrices to compare vendors.
• Maintain block and safe listings to maintain email hygiene, troubleshoot false positives and tune detection rules.
• Perform email investigations as required in response to phishing or BEC attempts, producing monthly vulnerability reports and prioritising remediation efforts based on risk.
• Work with infrastructure and application teams to test patches and drive vulnerability counts down.
• Attend monthly TAM meetings to review support cases and best practices.
• Maintain agility to substitute security products as business requirements evolve, ensuring policy continuity throughout transitions.

• 5+ years’ experience in a Cyber Security Analyst or similar role, with strong incident response and major incident handling expertise.
• Hands‑on experience with EDR (alert triage, policy management, sensor deployment), preferably Crowd Strike Falcon.
• Experience developing SOC playbooks, response actions, and running proof‑of‑concept evaluations and vendor comparisons.
• Confident, proactive communicator able to engage senior stakeholders, clearly explain complex security issues, and recommend actions.
• Collaborative and approachable, building trust with technical peers and supporting service desk and front‑line teams.
• Calm, effective, and resilient under pressure, particularly during security incidents in a front‑facing role.
• Formal qualifications not essential proven hands‑on experience and delivery record valued.

Technical Capabilities:

• Experience with SIEM platforms (e.g. Rapid7), Email Security and Data Security/DLP solutions (e.g. Varonis).
• Strong knowledge of Entra  features including Conditional Access and PIM, plus familiarity with PAM tools including Beyond Trust,…