Cyber Defence SecOps Analyst

About the role

A global enterprise is looking for a Cyber Defence SecOps Analyst with experience in security operations, vulnerability management, incident response and threat hunting. The role covers vulnerability assessment and remediation, security incident investigation, asset and scan coverage management and security tooling, with support for multiple workstreams and a shared 24/7 on-call rota.

Key responsibilities

• Analyse and prioritise vulnerabilities from Tenable, Microsoft Defender, CrowdStrike Falcon, Darktrace, GitHub Advanced Security and application security tools, tracking them from identification to closure and coordinating remediation with infrastructure, cloud, application and platform teams.
• Prioritise exposures by exploitability, CVSS, EPSS, CISA KEV, threat intelligence, asset criticality and attack paths.
• Investigate alerts and suspicious activity across endpoint, network, identity and cloud environments, supporting triage, containment and escalation.
• Conduct threat hunting using endpoint detection, network monitoring, cloud security and SIEM data, including emerging AI-enabled threats.
• Support application security (SAST, DAST, SCA, code review) and CI/CD pipeline security testing.
• Reconcile asset and scan data across tools and ServiceNow CMDB, identify coverage gaps and support external attack surface monitoring.
• Troubleshoot tool integrations, support vulnerability aggregation platforms such as Vulcan, and contribute to automation, scripting, dashboards and reporting.
• Take part in security testing, purple-team exercises, tool evaluations and AI-assisted security initiatives.
• Maintain incident records, handover documentation, remediation trackers and reporting inputs, and join the 24/7 on-call rota, responding to escalations within agreed timelines.

Required profile

• 3-5 years of experience in security operations, vulnerability management or cybersecurity engineering in an enterprise environment.
• Hands-on experience with vulnerability management and tools such as Tenable, CrowdStrike Falcon, Darktrace, Microsoft Defender and GitHub Advanced Security; familiarity with Vulcan or similar is preferred.
• Experience in incident response, alert triage and threat hunting across endpoint, network, identity and cloud environments.
• Strong analytical, troubleshooting, communication and stakeholder coordination skills, able to adapt to changing priorities and work an on-call rotation.
• Preferred: financial services or insurance experience, penetration testing, red/purple teaming, AI security testing, scripting in Python or PowerShell, and certifications such as Security+, CySA+, GCIH or OSCP.

Required skills

• Risk-based vulnerability prioritisation (CVSS, EPSS, CISA KEV, threat intelligence).
• Working knowledge of Windows, Linux, Azure, networking, SSDLC, CI/CD, SAST, DAST and SCA.
• ServiceNow or Jira, KQL or SQL querying, and reporting with Excel or Power BI.