Security Operations Specialist

Job Description

At Eurostar, we’re ushering in a new era of European train travel. We’re the only high‑speed operator that directly links the UK, France, Belgium, the Netherlands and Germany. We’ve got big ambitions to spark opportunity through the power of train travel, and we’d love to have you along for the ride.

We are looking for an IS Security Operations Specialist based in our head office in Kings Cross. The Information Security Department (IS) seeks a highly skilled, proactive specialist to administer and enhance our security monitoring and detection capabilities, ensure rapid and effective response to cyber incidents, and drive continuous improvements across our security operations.

• Administer and optimize security monitoring and detection tools, refining alert rules and triggers to enhance incident detection by optimizing Monitoring and Detection Systems:
  Consistently improve and fine‑tune security monitoring tools and alert rules to maximize timely detection and minimize false positives, including the health and scope of logging agents
• Provide expert guidance and support to the Cyber Incident Response Team (CIRT) for Level 1 incident response by leading and/or supporting timely and accurately Level 1 and Level 2 response to cybersecurity incidents, ensuring rapid containment, investigation, and remediation.
• Maintain and develop cyber response playbooks to standardize and streamline incident handling processes to keep aligned with evolving threat landscapes and organizational needs.
• Lead Level 1 and Level 2 responses to cyber security incidents escalated by SOCs or internal security teams when CIRT intervention is insufficient. Collect, analyse, and report security metrics regularly to provide actionable insights and maintain an up‑to‑date IT Security Dashboard and KPIs.
• Monitor IT and security infrastructure areas not covered by SOCs, ensuring comprehensive threat detection.
• Collect, analyse, and report security metrics to update KPIs and maintain the IT Security Dashboard.
• Identify and assess vulnerabilities and misconfigurations within IT security systems, services (e.g., email, DNS, Active Directory), and infrastructure.
• Ensure systems, equipment, and processes comply with internal IT security policies and standards.
• Vulnerability and Patch Management Oversight:
  Identify security vulnerabilities and misconfigurations proactively, track remediation progress, and validate the effectiveness of patch management processes.
• Extended Security Coverage:
  Provide proactive monitoring and support for IT and security infrastructure areas outside of SOC scope to ensure comprehensive threat visibility and protection.
• Assist and support the IT Security colleagues on IT Security initiatives when required.
• Keep current on technological developments in relation to cyber technologies and threats.

• Minimum bachelor’s degree in computer science, Information Security, Cybersecurity, or a related discipline.
• Relevant certifications such as CISSP, CISM, GIAC (GCIH, GCIA), CEH, or equivalent are highly preferred.
• Minimum 3 years’ experience in security operations, incident response, or SOC analyst roles.
• Proven expertise in managing and optimizing security monitoring and detection tools, including SIEM, IDS/IPS, and Endpoint Detection & Response platforms.
• Demonstrated ability to develop, maintain, and execute cyber response playbooks and incident handling procedures.
• Experience responding to Level 1 and Level 2 cybersecurity incidents and coordinating escalation processes.
• Solid background in vulnerability management, patch management validation, and compliance assurance.
• Strong familiarity with key security domains such as Email Security, Identity and Access Management, Network and Application Security, Cloud Security, DDoS & Bot protection, and Endpoint Security.
• Without being an expert in all technologies, already has knowledge and experience of configuration and trace analysis on the following systems:
• AWS, Azure and Microsoft 365 Security
• Endpoint Detection and Response
• Firewall and VPN
• Network Anomalies reporting tools
• SIEM Technology
• Experience with working with third party service providers