Cyber Security Incident Response & Threat Intelligence Analyst

Cyber Security Incident Response & Threat Intelligence Analyst

wThe Cyber Security Operations Team is responsible for monitoring, detecting, and responding to cyber threats across Thomas Millers estate. We ensure the protection of digital assets and safeguard confidentiality, integrity and availability of systems. Working in a fast-paced environment, the SOC provides 24/7 vigilance, rapid incident response, vulnerability oversight and actionable threat intelligence to reduce cyber risk

r?

We are seeking a Cyber Security Incident Response & Threat Intelligence Analyst to strengthen our SOC capability. The successful candidate will focus primarily on incident response while also supporting threat intelligence analysis. This hybrid role ensures we can both react quickly to active threats and proactively reduce risk exposure through continuous threat monitoring and remediation efforts. The ideal candidate will have an in-depth understanding of the overall security landscape, be experienced in cyber security incident response, with a keen ability to detect and respond to complex security incidents, tuning detection systems to spot attacker Tactics, Techniques, and Procedures (TTPs)

They will lead responses to active incidents, collaborating with IT, security, and business stakeholders to mitigate threat actors from our systems as quickly as possibl le.

They should have a deep understanding of threat detection techniques, advanced persistent threats (APT), and incident handling procedures. They will provide technical mentorship to junior members of the team, and act as an escalation tier for complex analysis. We are looking for an individual who can balance technical risks against business risks and consistently drive for the right results.

The successful candidate will have a good mix of deep technical knowledge, a demonstrated background in information security, and an analytical mindset that is driven by curiosity.

We value broad and deep technical knowledge, specifically in the fields of operating system security, network security, software security, malware analysis, forensics, security operations, incident response, and emergent security intelligence.

• Respond to and investigate cyber security incidents, including malware outbreaks, phishing attempts, insider threats and handle digital forensics.
• Continuously improve our monitoring systems' detection and response capabilities as well as processes, procedures, and playbooks.
• Lead Incident Response efforts when dealing with confirmed security incidents.
• Automate analysis and response steps to reduce manual toil.
• Help prioritise the creation of new SOC use cases to ensure optimum ROI for engineering effort.
• Monitor security alerts and suspicious activities from a variety of SOC tools.
• Utilise Microsoft security tools such as Microsoft Defender for Endpoint, Microsoft 365 Defender, and Azure Security Centre to detect, respond to, and mitigate security incidents.
• Perform root cause analysis to determine how breaches or incidents occurred and implement long term prevention strategies.
• Collaborate with other IT and security teams to address vulnerabilities and strengthen security posture.
• Conduct post-incident analysis to identify areas for improvement and lessons learned.
• Maintain detailed records of security incidents, including incident timelines, analysis, and resolutions.
• Plan and execute monitoring system architectural changes.
• Communicate effectively at multiple levels of sensitivity, and multiple audiences.
• Recognise, adopt and install the best practices in security engineering fields throughout the organisation: development, cryptography, network security, security operations, incident response, security intelligence.
• Gather, analyse and disseminate threat intelligence from internal and external sources. Provide intelligence driven recommendations for improved SOC detection and controls.

• Hands‑on experience with vulnerability management tools (e.g., Nessus, Qualys, Rapid7).
• Familiarity with threat intelligence platforms (e.g., Recorded Future, Threat Connect, Mandiant).
• Experience with SOC tools such as:…