Cyber Security Operations Analyst

The Job: SecOps Analyst

 

The SecOps Analyst is a hands-on technical role responsible for investigating Cyber Security incidents, producing security reporting and acting as a fourth-line technical escalation point for the Service Desk for security and cloud related tickets.

 

The role will monitor, investigate and respond to security alerts and incidents across Frontline and customer environments, using available security technologies and technical evidence to assess risk, determine appropriate actions and support remediation.

 

The analyst will also provide senior technical support for complex security and cloud related incidents escalated by the Service Desk. This will involve taking technical ownership of investigations, performing advanced troubleshooting and working with internal resolver groups, vendors and technology partners to drive incidents through to resolution.

 

Working closely with the Cyber Security Manager and wider Managed Services team, the role will contribute to the continual improvement of Frontline's Cyber Security services, technical support capabilities, reporting, processes, automation and documentation.

 

Principle Responsibilities:

 

• Monitor, investigate and respond to Cyber Security alerts, tickets and incidents across Frontline and customer environments.
• Analyse technical evidence to determine the severity, scope and potential impact of security events, recommending appropriate containment and remediation actions.
• Take ownership of Cyber Security investigations through to resolution or appropriate escalation.
• Escalate significant security incidents and risks to the Cyber Security Manager.

• Work with internal resolver groups, vendors and technology partners to drive escalated incidents through to resolution.
• Produce accurate Cyber Security reports for customers and internal stakeholders.
• Analyse security incidents, alerts, vulnerabilities and trends, highlighting significant risks and areas requiring attention.
• Provide clear commentary that translates technical findings into meaningful information for technical and non-technical audiences.
• Contribute to incident reporting, root cause analysis and customer service reviews.
• Maintain Cyber Security documentation, runbooks, playbooks and knowledge articles.
• Identify opportunities to improve security monitoring, investigation, response and Service Desk processes.
• Support automation and improvements to Cyber Security tooling and reporting.
• Share knowledge across the Service Desk and wider Managed Services team.

 

Essential Skills and Experience

The successful candidate will have:

• Experience working within IT support, Cyber Security or a related technical service environment.
• Strong practical experience troubleshooting complex technical incidents.
• Experience managing tickets, incidents and technical escalations within a structured support environment.
• Practical experience investigating security alerts, incidents or security-related technical issues.
• A broad technical understanding of Microsoft 365, Azure, Windows, identity, endpoint and networking technologies.
• Understanding of common Cyber Security threats, vulnerabilities, attack techniques and indicators of compromise.
• Familiarity with technologies such as SIEM, EDR/XDR, firewalls, identity protection and vulnerability-management solutions.
• The ability to analyse technical information from multiple sources and determine an appropriate course of action.
• The ability to take technical ownership of complex incidents whilst recognising when specialist or management escalation is required.
• Strong troubleshooting and problem-solving skills.
• Strong written and verbal communication skills, with the ability to explain technical information to both technical and non-technical audiences.
• A customer-focused approach and the ability to remain methodical when dealing with high-priority or business-critical incidents.

 

Desirable Skills and Experience

Experience or working knowledge of the following would be advantageous:

• Working within an MSP, MSSP, SOC or Cyber Security Operations environment.
• Microsoft Sentinel and Microsoft Defender XDR.
• Microsoft Defender for Endpoint, Defender for Identity, Defender for Office 365 or Defender for Cloud.
• Microsoft Entra ID and associated identity-security capabilities.
• Kusto Query Language (KQL).
• SIEM and security-event investigation.
• Endpoint Detection and Response technologies.
• Vulnerability-management technologies such as Tenable Nessus or Qualys.
• Firewall and network-security technologies.
• Investigation of identity, email, endpoint and cloud security incidents.
• MITRE ATT&CK framework
• Root cause analysis and post-incident reviews.
• Development or maintenance of security runbooks and playbooks.
• Automation of technical or Cyber Security operational activities.
• ITIL-aligned incident, problem and change-management processes.
• Experience using AI-assisted technologies, such as Microsoft Copilot, to support troubleshooting, automation, documentation and incident response.

 

Person Requirements:

 

• Have a strong interest in Cyber Security and technology.
• Be inquisitive, analytical and comfortable investigating complex problems.
• Take ownership and responsibility for progressing technical incidents.
• Know when to continue an investigation and when specialist or management escalation is appropriate.
• Remain calm and methodical during high-priority incidents.
• Communicate clearly and professionally with customers and colleagues.
• Be comfortable providing technical guidance to other support teams.
• Have strong attention to detail, particularly when documenting investigations and producing reports.
• Be willing to share knowledge and support the development of Service Desk colleagues.
• Look for opportunities to improve processes rather than repeatedly resolving the same problems.
• Work effectively independently and as part of the wider Managed Services team.
• Handle customer and security information professionally and confidentially.

 

Qualifications

Relevant vendor certifications are desirable and may include:

• Microsoft Certified: Security Operations Analyst Associate.
• Microsoft Certified: Azure Security Engineer Associate.
• Microsoft Certified: Cybersecurity Architect Expert.
• CompTIA Security+ or an equivalent security qualification.
• ITIL 4 Foundation.
• Relevant vendor or technology certifications.

Equivalent knowledge gained through practical industry experience will also be considered.

 

Working Environment:

1. This position is a hybrid environment, working remotely from home and in the office at Handforth in line with our Remote Working Policy, some out of hours and weekend work will be required.
2. Working hours are 37.5 hours per week.

Benefits:

1. Company laptop
2. Company enrolled benefits package.
3. 22 standard days annual leave plus UK bank holidays.
4. 1 additional annual leave day on your birthday.
5. 2 additional annual leave days entitlement at Christmas.
6. Pension Scheme after 3 months of service.