Security Operations Analyst (Ref 26629)

Responsibilities

Security Monitoring & Incident Response

• Monitor alerts and dashboards across Trend Micro (e.g. Vision One, Deep Security, Apex One), Microsoft Sentinel, and other security tools

• Triage alerts, separate true from false positives, and prioritise by severity and business impact

• Investigate suspicious activity using log analysis, KQL queries, and threat intelligence

• Escalate confirmed incidents to L2/L3 or the incident response team with clear evidence

• Carry out initial containment per playbooks, such as isolating endpoints or blocking indicators

• Tune detection rules and alert thresholds to reduce noise

Data Loss Prevention (DLP)

• Monitor and triage DLP alerts for unauthorised transfer, sharing, or exfiltration of sensitive data

• Investigate policy violations, determine whether they are accidental, negligent, or malicious, and escalate as required

• Review and tune DLP policies and rules to reduce false positives

• Coordinate with data owners, HR, and compliance on confirmed data leakage incidents

• Report DLP incident trends and policy effectiveness

Vulnerability Management

• Run and review vulnerability scans using Tenable and similar tools

• Prioritise findings by severity (CVSS), exploitability, and asset criticality

• Raise remediation tickets, track them to closure, and escalate overdue items

• Manage risk acceptance and exception requests with supporting justification

• Produce vulnerability and patch compliance reports for management and audits

Documentation & Reporting

• Document incidents and investigations in the ticketing system (e.g. ServiceNow)

• Maintain SOC playbooks, runbooks, and SOPs

• Prepare shift handover notes and regular security reports

• Support audits, compliance checks, and post-incident reviews

Requirements

• Diploma or Bachelor’s degree in Cybersecurity, IT, Computer Science, or a related field (or equivalent experience)

• 2-4 years in a SOC, security operations, or IT security role

• Hands-on experience with a SIEM (Microsoft Sentinel preferred) and endpoint or XDR tools (Trend Micro preferred)

• Experience with vulnerability scanners (Tenable preferred) and patch management processes

• Understanding of DLP concepts and tools, and of the incident response lifecycle and MITRE ATT&CK

• Preferred certifications: CompTIA Security+, Microsoft SC-200, or Trend Micro certifications

• Nice to have: CEH, GCIH, GCIA, Tenable certifications, or Azure/AWS security certifications

Skills

• Strong knowledge of network, endpoint, cloud, and OS security (Windows, Linux)

• Ability to write and read KQL queries and analyse logs

• Familiarity with firewalls, IDS/IPS, WAF, EDR/XDR, DLP, and vulnerability scanners

• Understanding of CVSS scoring, CVE tracking, and risk-based remediation prioritisation

• Strong analytical thinking, attention to detail, and clear written and verbal communication

• Ability to work with infrastructure and application teams to drive remediation

• Calm and effective under pressure and in shift work

Licence no: 12C6060