The posting
Description
The Cyber Security Analyst is responsible for continuously monitoring, analysing, triaging and resolving cybersecurity events and alerts generated by Income's SIEM System and other security platforms in a managed SOC environment. The role also strengthens threat detection capabilities by identifying detection gaps, enhancing use cases and improving security monitoring processes. Where an event is confirmed as a security incident, the analyst will work with relevant stakeholders and the Security Operations Manager to investigate, contain, remediate and recover from the incident.
This role sits within the IT Risk and Security Department and reports to the Security Operations Manager.
Key Responsibilities
- Continuously monitor, analyse, triage and close security events, alerts and requests received from the managed SOC, security systems and users.
- Support the Incident Manager and relevant stakeholders in investigating, containing, remediating and recovering from security incidents to minimise business impact.
- Enhance SOC detection and response playbooks, develop new incident-response procedures, and maintain clear processes for escalation, communication, evidence collection and documentation.
- Use analytical and data-visualisation tools to automate analysis, derive insights from large datasets, correlate information across SIEM and other data sources, and investigate anomalous activity against established baselines to determine root cause.
- Apply AI-driven and machine-learning capabilities, where appropriate, to support real-time security investigations, threat triage, containment and remediation, escalating issues when required.
- Apply ethical-hacking knowledge to identify potential threats and vulnerabilities and recommend appropriate remediation measures.
- Perform digital-forensics analysis of security events and alerts while following established evidence-handling and chain-of-custody practices.
- Apply reverse-engineering techniques, where required, to understand software behaviour and support malware analysis.
- Develop security-monitoring reports, metrics and dashboards for asset owners and management.
- Stay current with emerging cyber threats, vulnerabilities, attack techniques and industry developments, and translate relevant intelligence into detection and response improvements.
- Participate in cybersecurity exercises, including cyber-range simulations and business continuity exercises.
- Support cybersecurity projects and perform other duties assigned by the Security Operations Manager.
- Coordinate the renewal and maintenance of cybersecurity tools, including tracking licences, support arrangements and vendor deliverables.
Qualifications
- At least 4 years of hands-on information-security experience in a SOC analyst, incident-response analyst, incident-handler or comparable role. Experience in a financial-institution SOC environment and incident management is preferred.
- Strong hands-on cybersecurity experience with enterprise SIEM platforms, such as Google Security Operations SIEM, together with a sound understanding of the cyber kill chain, tactics, techniques and procedures (TTPs), threat intelligence and malware triage.
- Ability to analyse large datasets and packet-level data, operate network and endpoint security technologies, including NIDS/NIPS, firewalls, HIPS, proxies, anti-malware tools, vulnerability scanners and interpret the security events they generate.
- Strong understanding of common attacks targeting systems, networks and applications.
- Strong knowledge of internet infrastructure, networking and network security, including DNS, DHCP, firewalls, WAF, IDS/IPS, VPN, advanced persistent threats and TCP/IP protocols.
- Relevant industry certifications, such as Certified SOC Analyst (CSA), CISSP, CEH, GIAC Certified Intrusion Analyst (GCIA), GIAC Certified Incident Handler (GCIH), or equivalent, are preferred.
- Strong analytical and problem-solving skills, with a self-motivated, detail-oriented and collaborative approach.
- Malware triage and analysis capability is an advantage.
- Willingness to learn and contribute effectively in a collaborative team environment.
- Ability to remain composed, prioritise effectively and work under pressure during cyber security incident investigation and response.
- Good interpersonal, written and verbal communication skills.
