Cyber Incident Response Analyst

Job Specification

The Opportunity

We are seeking a Cyber Incident Response Analyst to join a security-focused team, supporting the identification, investigation, containment and resolution of cyber security incidents across a complex technology environment.

The successful candidate will play an important role in the organisation's incident response capability, working alongside security operations, threat intelligence, digital forensics and wider technology teams to manage and mitigate cyber threats.

This is an opportunity for a technically capable security professional with a strong investigative mindset, who can operate effectively in a fast-paced environment and contribute to the ongoing development of incident response processes and capabilities.

Key Responsibilities

• Monitor, investigate and respond to cyber security incidents, assessing severity, impact and potential business exposure.
• Conduct detailed investigations into security alerts, suspicious activity and potential compromises.
• Support incident containment, eradication and recovery activities to minimise operational and business disruption.
• Analyse endpoint, network, system and security telemetry to identify indicators of compromise (IOCs) and attack patterns.
• Investigate phishing, malware, ransomware, unauthorised access and other security incidents.
• Work with SOC, threat intelligence and digital forensics teams to support coordinated incident response.
• Perform root cause analysis and contribute to post-incident reviews and lessons learned.
• Develop and maintain incident response documentation, playbooks and procedures.
• Identify opportunities to improve detection, response processes and overall security posture.
• Produce clear technical incident reports and communicate findings to relevant technical and business stakeholders.

Technical Experience & Expertise

Candidates should demonstrate experience or knowledge across several of the following areas:

• Incident Response: Security incident investigation, triage, containment, eradication and recovery.
• SIEM Technologies: Splunk, Microsoft Sentinel, IBM QRadar or equivalent platforms.
• EDR / XDR: CrowdStrike Falcon, Microsoft Defender, SentinelOne or similar technologies.
• Digital Forensics: Endpoint investigation, log analysis, evidence collection and forensic methodologies.
• Threat Intelligence: Indicators of compromise, threat actor TTPs and MITRE ATT&CK framework.
• Network Security: Network traffic analysis, firewall logs, intrusion detection and suspicious network activity.
• Operating Systems: Windows, Linux and cloud-based environments.
• Cloud Security: Experience investigating incidents across Azure, AWS or Microsoft 365 environments.

Skills & Personal Attributes

• Strong analytical and investigative capabilities with excellent attention to detail.
• Ability to assess complex technical information and identify potential security threats.
• Calm and methodical approach when working under pressure.
• Strong problem-solving and decision-making skills.
• Effective communication skills, with the ability to articulate technical findings clearly.
• Collaborative approach to working across security and technology functions.
• Proactive attitude towards continuous learning and developing technical expertise.

Qualifications & Certifications

Relevant qualifications and certifications may include:

• CompTIA Security+
• GCIH – GIAC Certified Incident Handler
• GCIA – GIAC Certified Intrusion Analyst
• GCFA – GIAC Certified Forensic Analyst
• Microsoft Security Operations Analyst (SC-200)
• CISSP or equivalent security qualifications

Experience

Typically 2–5 years' experience within cyber security operations, security incident response, SOC or digital forensics environments.

Candidates with demonstrable hands-on incident investigation and response experience will be particularly attractive.

What Success Looks Like

• Effective identification, investigation and management of security incidents.
• Timely containment and mitigation of cyber threats.
• High-quality technical investigations and incident reporting.
• Improved incident response processes, playbooks and operational effectiveness.
• Strong collaboration with wider security and technology stakeholders.