Incident Response Analyst

• Monitor and analyse alerts from SIEM, EDR/XDR, identity, email, cloud, network, and other security platforms
• Triage alerts, validate incidents, assess severity and business impact, and escalate according to defined processes and service levels
• Lead or support investigations into phishing, malware, account compromise, unauthorised access, data loss, and network-based attacks
• Coordinate containment, eradication, and recovery activities with internal teams and client stakeholders
• Maintain incident records, timelines, evidence, actions, and decision logs
• Produce incident reports, management updates, and post-incident summaries
• Collect, preserve, and analyse endpoint, server, identity, network, email, and cloud artefacts
• Perform host and network analysis using security logs, packet captures, forensic images, and telemetry data
• Identify indicators of compromise and attacker TTPs, mapping findings to MITRE ATT&CK
• Support sensitive investigations while maintaining evidence integrity and chain-of-custody requirements
• Develop and execute proactive, intelligence-led threat hunting activities
• Create, tune, and optimise detection rules, correlation logic, monitoring content, and custom indicators
• Identify detection gaps and improve detection and response capabilities
• Support purple-team exercises, penetration testing, and security control validation
• Act as a trusted security advisor during incidents and lead client communications
• Facilitate incident review meetings and present findings, recommendations, and lessons learned
• Collaborate with Security Operations, Professional Services, and Customer Success teams
• Develop, maintain, and improve incident response plans, playbooks, runbooks, and procedures
• Conduct post-incident reviews and root cause analyses
• Contribute to service reporting, risk indicators, trend analysis, and operational metrics
• Support cyber simulations and tabletop exercises
• Stay current with emerging threats, attack techniques, vulnerabilities, and industry best practices