The posting
Responsibilities
• Act as the Enterprise Cyber Security technical focal point during cyber incidents, working closely with SOC, CISO, infrastructure, network, cloud, application, and vendor teams.
• Support cyber incident response activities including triage, investigation, containment coordination, evidence gathering, remediation tracking, and post incident review.
• Conduct proactive threat hunting across Enterprise infrastructure using available telemetry from SIEM, EDR, NDR, vulnerability management, asset discovery, and other security tools.
• Identify suspicious behaviours, attack patterns, lateral movement indicators, privilege misuse, exposed services, anomalous access, and other signs of compromise.
• Develop and enhance threat hunting hypotheses, detection use cases, investigation playbooks, response procedures, and escalation workflows.
• Support improvement of security monitoring by identifying gaps in logs, telemetry, asset visibility, EDR/NDR/SIEM coverage, and detection rules.
• Work with SOC and central security teams to improve alert quality, detection coverage, investigation context, and incident response readiness.
• Support vulnerability management and risk-based remediation by correlating vulnerabilities with asset criticality, exposure, threat intelligence, and compensating controls.
• Support Enterprise cybersecurity initiatives including NDR deployment, asset discovery, micro-segmentation, Zero Trust controls, PIAM/IAM adoption, and security tool integration.
• Participate in security assessments, threat reviews, tabletop exercises, incident simulations, and lessons-learned activities.
• Support root cause analysis and ensure remediation actions from cyber incidents, audit findings, vulnerability reviews, and threat hunting activities are tracked to closure.
• Prepare management reports, investigation summaries, threat hunting findings, risk updates, incident dashboards, and security posture metrics.
• Support cybersecurity audits, regulatory requests, internal governance activities, and evidence collection where related to incident response, monitoring, and security controls.
• Maintain and improve technical documentation including incident response runbooks, threat hunting procedures, SOPs, escalation guides, and operational checklists.
• Provide guidance to internal teams on security best practices, incident handling, evidence preservation, secure configuration, and remediation actions.
Requirements
• Bachelor’s degree or diploma with relevant experience in Cybersecurity, Information Technology, Computer Science, Engineering, or a related field.
• Minimum 7 years of experience in cybersecurity operations, incident response, threat hunting, SOC operations, detection engineering, infrastructure security, or related roles.
• Strong understanding of cyber incident response lifecycle, including detection, triage, containment, eradication, recovery, and post-incident review.
• Hands-on experience with security technologies such as SIEM, EDR, NDR, vulnerability management, threat intelligence platforms, asset discovery tools, firewalls, and endpoint/network security controls.
• Good understanding of network security, TCP/IP, routing, firewalls, VPNs, DNS, authentication, Windows/Linux systems, Active Directory, and cloud security fundamentals.
• Experience analysing logs, alerts, network traffic, endpoint telemetry, user activity, and security events to identify threats or suspicious behaviours.
• Familiarity with MITRE ATT&CK, Cyber Kill Chain, threat hunting methodologies, and common attacker tactics, techniques, and procedures.
• Exposure to tools and technologies such as Microsoft Sentinel, Splunk, CrowdStrike, Tenable, Qualys, Darktrace, Palo Alto, Illumio, CyberArk, Delinea, Device42, or similar platforms.
• Ability to work across multiple teams during incidents and security projects, including SOC, CISO, infrastructure, network, application, cloud, GRC, and vendor teams.
• Strong analytical, troubleshooting, documentation, stakeholder management, and communication skills.
Licence no: 12C6060
