Security Operations Analyst (Ref 26629)

Responsibilities Security Monitoring & Incident Response • Monitor alerts and dashboards across Trend Micro (e.g. Vision One, Deep Security, Apex One), Microsoft Sentinel, and other security tools • Triage alerts, separate true from false positives, and prioritise by severity and business impact • Investigate suspicious activity using log analysis, KQL queries, and threat intelligence • Escalate confirmed incidents to L2/L3 or the incident response team with clear evidence • Carry out initial containment per playbooks, such as isolating endpoints or blocking indicators • Tune detection rules and alert thresholds to reduce noise Data Loss Prevention (DLP) • Monitor and triage DLP alerts for unauthorised transfer, sharing, or exfiltration of sensitive data • Investigate policy violations, determine whether they are accidental, negligent, or malicious, and escalate as required • Review and tune DLP policies and rules to reduce false positives • Coordinate with data owners, HR, and compliance on confirmed data leakage incidents • Report DLP incident trends and policy effectiveness Vulnerability Management • Run and review vulnerability scans using Tenable and similar tools • Prioritise findings by severity (CVSS), exploitability, and asset criticality • Raise remediation tickets, track them to closure, and escalate overdue items • Manage risk acceptance and exception requests with supporting justification • Produce vulnerability and patch compliance reports for management and audits Documentation & Reporting • Document incidents and investigations in the ticketing system (e.g.

ServiceNow) • Maintain SOC playbooks, runbooks, and SOPs • Prepare shift handover notes and regular security reports • Support audits, compliance checks, and post-incident reviews Requirements • Diploma or Bachelor’s degree in Cybersecurity, IT, Computer Science, or a related field (or equivalent experience) • 2-4 years in a SOC, security operations, or IT security role • Hands-on experience with a SIEM (Microsoft Sentinel preferred) and endpoint or XDR tools (Trend Micro preferred) • Experience with vulnerability scanners (Tenable preferred) and patch management processes • Understanding of DLP concepts and tools, and of the incident response lifecycle and MITRE ATT&CK • Preferred certifications: CompTIA Security+, Microsoft SC-200, or Trend Micro certifications • Nice to have: CEH, GCIH, GCIA, Tenable certifications, or Azure/AWS security certifications Skills • Strong knowledge of network, endpoint, cloud, and OS security (Windows, Linux) • Ability to write and read KQL queries and analyse logs • Familiarity with firewalls, IDS/IPS, WAF, EDR/XDR, DLP, and vulnerability scanners • Understanding of CVSS scoring, CVE tracking, and risk-based remediation prioritisation • Strong analytical thinking, attention to detail, and clear written and verbal communication • Ability to work with infrastructure and application teams to drive remediation • Calm and effective under pressure and in shift work Licence no: 12C6060