Security Operation Analyst
21 hours ago
London
Please do not apply if you are seeking your first role in cyber security - look out for our Graduate SOC Analyst roles instead Salary: 40,00046,000 depending on experience Shares: We operate an EMI scheme and you will earn over time a slice of the CyPro pie. Holiday: 25 days paid holiday plus bank holidays (increases by 1 day per year worked up to 30 days) Flexible Working: We love getting the team together in the office, so we typically spend three days per week together in our lovely London office (39 floors up in Canary Wharf ). Working Hours: 4 days on, 4 days off, rotating day/night shifts Training: Budget for one certification/course per year Start Date: ASAP We are an innovative cyber security start-up united in a shared mission: to redefine cyber security for small and medium-sized businesses (SMBs). Our Founders Jonny & Rob spent most of their early careers delivering cyber security for large enterprises and central government. They saw a clear need for a new approach to cyber security as SMBs became increasingly targeted by cyber criminals. Together, CyPro is already setting new standards, defining innovative solutions and equipping its clients with the cyber security they need to prevent attacks, secure bigger clients and scale to new heights. At CyPro, youll have the opportunity to get involved in a wide range of areas including monitoring, incident response, threat intelligence, detection engineering, automation and internal security operations. Youll play a key role in our Security Operations Centre, delivering 365-day monitoring, detection and response to our growing customer base. Youll contribute to building out our capabilities, improving tooling and processes, and shaping how we operate as the function matures. As the team grows further, youll have the flexibility to focus more deeply on the areas that interest you most whether thats advanced detection engineering, threat intelligence, incident response leadership or platform automation. If youre ambitious and want to help shape something rather than simply follow a process, this is the right environment for you. Security Monitoring & Incident Response Monitor security alerts generated by Microsoft Sentinel, Microsoft Defender, Datadog and Elastic. Correlate data across platforms to identify anomalies, malicious patterns and attacker behaviour. Develop and implement new detection rules in Microsoft Sentinel aligned to the MITRE ATT&CK framework. Refine existing detection logic based on false positive analysis and threat evolution. Threat Intelligence & Enrichment Analyse threat intelligence feeds to identify relevant threats and vulnerabilities. Participate in proactive threat hunting sprints to identify risks before they escalate. Respond to client queries regarding investigations, coverage and data flows. Internal Security Operations Support the management of CyPros internal security environment. Help ensure our internal security posture reflects the same standards we deliver to clients. Professional Development Actively participate in ongoing training and capability development. Youll need to operate in an environment with few guardrails and help build things as we grow. # Always Improving were a growing business and want our people to grow with us. University educated with a degree in computer science, information security or equivalent At least one year of experience in a SOC environment monitoring and responding to incidents Microsoft Sentinel and Defender hands-on expertise Experience with SIEM, IDS/IPS and threat intelligence platforms Familiarity with incident response frameworks and security best practice Identify, troubleshoot and resolve complex security issues. Attention to Detail: Ensure accurate detection, analysis and documentation. Analytical Thinking: Comfortable interpreting complex security data. Dive into data sets and problems to uncover patterns and root causes. Intro Discussion (20 minutes, Remote): An initial chat to learn more about you and the role. # A mini project on-site (no prep required), some quick tests, followed by a final interview with the founders and our SOC Manager.