Incident Response Analyst – Cyber Security

We’re looking for an experienced Incident Response Analyst to support a cyber security function, helping to detect, investigate, contain and resolve cyber security incidents across a complex enterprise environment.

This is an excellent opportunity for a hands‑on cyber security professional with strong experience in incident response, security operations, threat hunting and digital forensics.

As an Incident Response Analyst, you’ll be responsible for investigating security alerts, managing cyber incidents and coordinating response activities across infrastructure, cloud, identity and endpoint environments. You’ll work closely with technical teams and key business stakeholders throughout the incident lifecycle, ensuring incidents are effectively managed, evidence is preserved and lessons learned are translated into improvements across security controls and response capabilities.

• Monitor and investigate security alerts across SIEM, EDR/XDR, identity, email, cloud and network security platforms.
• Triage incidents, assess severity and business impact, and coordinate appropriate escalation and response activities.
• Investigate cyber security incidents, including phishing, malware, compromised accounts, data loss, unauthorised access and suspicious network activity.
• Coordinate containment, eradication and recovery activities with infrastructure, cloud, identity and application teams.
• Identify indicators of compromise and attacker tactics, techniques and procedures, using frameworks such as MITRE ATT&CK.
• Perform proactive threat hunting to identify suspicious activity and potential threats that may have bypassed existing security controls.
• Develop, tune and improve detection rules, monitoring use cases, queries and incident response processes.

• Proven experience in cyber security incident response, security operations or a SOC environment.
• Hands‑on experience investigating security incidents using SIEM and EDR/XDR technologies.
• Strong understanding of Windows and Linux security artefacts, authentication logs, network traffic and packet analysis.
• Understanding of enterprise networking, identity and access management, cloud security, email security and endpoint protection.
• Experience producing technical investigation reports, incident documentation and stakeholder updates.
• Strong analytical and problem‑solving skills, with the ability to make sound decisions under pressure.
• Excellent communication skills, with the ability to work effectively with technical teams and senior stakeholders.