Incident Response Analyst

Overview

We are seeking an experienced Incident Response Analyst to join a growing Cyber Security function. This role is responsible for detecting, triaging, investigating and coordinating the resolution of cyber security incidents across a complex enterprise environment. The successful candidate will play a key role in reducing business risk, improving cyber resilience and enhancing incident response capabilities through threat hunting, digital forensics and continuous security improvement.

Key Responsibilities

• Monitor, triage and investigate cyber security alerts and incidents across enterprise environments.
• Lead and support incident response activities, including containment, eradication and recovery.
• Conduct digital forensic investigations to determine scope, root cause and impact of security incidents.
• Analyse endpoint, network, cloud and identity-based security events to identify threats and compromised assets.
• Perform proactive threat hunting and develop detection rules to improve security monitoring capabilities.
• Maintain accurate incident records, produce investigation reports and provide updates to technical and senior stakeholders.
• Support post-incident reviews, root cause analysis and implementation of lessons learned.
• Develop and maintain incident response playbooks, procedures and governance documentation.
• Contribute to cyber exercises, simulations and continual improvement of the organisation's security posture.
• Collaborate with technology, business, risk, compliance and third-party teams throughout the incident lifecycle.

Skills & Experience Essential

• Practical experience in cyber incident response, security monitoring or a Security Operations Centre environment.
• Hands-on experience investigating security alerts and incidents using SIEM and EDR/XDR technologies.
• Experience analysing Windows and Linux host artefacts, authentication activity, security logs, network traffic and packet captures.
• Working knowledge of incident response lifecycle activities including preparation, detection, analysis, containment, eradication, recovery and lessons learned.
• Experience producing incident records, investigation reports, management updates and post-incident findings.
• Understanding of attacker behaviours and frameworks including MITRE ATT&CK, Cyber Kill Chain and NIST incident response guidance.
• Knowledge of enterprise networking, identity and access management, cloud services, email security, endpoint security, vulnerability management and data loss prevention.
• Ability to manage multiple priorities, exercise sound judgement under pressure and communicate clearly with technical and senior stakeholders.
• Awareness of evidence handling, forensic integrity, confidentiality and regulatory considerations relevant to cyber investigations.

Desirable

• Experience in banking, financial services or another regulated environment.
• Experience with threat intelligence, malware analysis, scripting or automation using PowerShell, Python, KQL or similar languages.
• Experience developing detection rules, response playbooks, threat hunts or security orchestration and automation workflows.
• Knowledge of Microsoft security technologies such as Sentinel, Defender XDR, Defender for Identity and Defender for Cloud, or equivalent platforms.
• Exposure to forensic tools such as EnCase, FTK, Velociraptor, Volatility, Wireshark or equivalent.
• Understanding of cloud investigation techniques across Microsoft Azure, Microsoft 365 or other major cloud platforms.

Qualifications

• Relevant professional experience supported by a degree in Cyber Security, Computer Science or a related discipline, or equivalent practical experience.
• One or more relevant certifications such as GCIH, GCIA, GCFA, GNFA, SC-200, CySA+, CISSP or equivalent are desirable.
• Sound knowledge of information security principles, recognised standards and regulatory expectations, including NIST, CIS Controls and relevant privacy requirements.

Disclaimer:

This vacancy is being advertised by either Advanced Resource Managers Limited, Advanced Resource Managers IT Limited or Advanced Resource Managers Engineering Limited ("ARM"). ARM is a specialist talent acquisition and management consultancy. We provide technical contingency recruitment and a portfolio of more complex resource solutions. Our specialist recruitment divisions cover the entire technical arena, including some of the most economically and strategically important industries in the UK and the world today. We will never send your CV without your permission. Where the role is marked as Outside IR35 in the advertisement this is subject to receipt of a final Status Determination Statement from the end Client and may be subject to change.