Security Analyst, Incident Response; GSOC

Job Description

You will be a key member of the RBC Global Security Incident Response team as an experienced Security Analyst. This role is a core position within the Global Security Operations Centre (GSOC), providing technical expertise and leadership support for proactive and reactive responses to cyber threats targeting RBC's global environment.

You will report to the Senior Manager, Incident Response and work with a team of 4-6 technical specialists. You will act as the focal point of contact for GSOC management regarding security incidents, and you will provide support to local and extended team members with critical incidents impacting RBC users, systems, infrastructure, and resources. This is a permanent, full‑time position requiring four days per week in our London Fenchurch office.

• Global accountability to respond to critical security incidents/events, providing accurate and timely reporting to Global Cyber Security Leadership.
• Provide 24/7/365 support for security incidents impacting mission‑critical business and IT infrastructure, including incident management, response, remediation, and reporting.
• Support and maintain communication with the CSIRT extended team, ensuring timely communication to all stakeholders regarding incident response activities.
• Provide post‑mortem reporting to leadership detailing security vulnerabilities, technology gaps, shortcomings, or other security issues.
• Work with threat intelligence, SOC, and extended teams to ensure global compliance with RBC standards concerning security incidents and related findings.
• Drive resolution of security incidents in a timely and effective manner.
• Collaborate with Cybersecurity Command Centre analysts, specialists, and management to detail and report on the status and resolution of critical incidents.
• Execute incident response actions and engage with business/technical stakeholders.

• Bachelor's degree in computer science, IT, or related disciplines and information security certifications (e.g., CISSP, GCIA, GCIH, GREM, CEH).
• Demonstrated experience performing investigation activities for security-related events in a complex Incident Management or SOC environment.
• Thorough understanding of Security Information and Incident Management methodologies.
• Proven experience in a SOC environment.
• Exposure to malware and sandbox analysis.
• Robust knowledge of computer networking and operating systems.

• Experience with SOAR platforms.
• Familiarity with threat hunting techniques and scenarios.
• Knowledge in detection engineering.
• Understanding of current threat landscape and threat actor TTPs.
• Experience with scripting languages (Power Shell, Python, regex, Bash, etc.).
• Industry-recognized certifications from ISC2, SANS, ISACA, etc.

• Opportunity to help develop the ethos and environment of a new team.
• Leadership who will support your development through coaching and growth opportunities.
• Chance to work with top professionals in the field.
• Ability to make a lasting impact.
• Dynamic, collaborative, progressive, high-performing team environment.