Cybersecurity Incident Response Analyst

A Cybersecurity Incident Response Analyst is needed to join the Security Operations Centre of a global financial services organisation, helping to detect, investigate, contain and resolve cybersecurity incidents across the EMEA region. You will be responsible for: Monitoring and analysing alerts from SIEM, EDR/XDR, identity, email, cloud and network controls to identify suspicious or malicious activity. Triaging alerts, validating incidents, assessing severity and business impact, and escalating in line with defined processes and service levels. Leading or supporting investigations into phishing, malware, account compromise, data loss, unauthorised access and suspicious network activity. Coordinating containment, eradication and recovery with infrastructure, application, identity, cloud and business teams. Maintaining case records, investigation timelines, evidence and decision logs. Collecting, preserving and analysing endpoint, server, identity, network, email and cloud artefacts. Identifying indicators of compromise and threat actor behaviour, and documenting findings in a clear, standardised format. Safeguarding evidence integrity and chain of custody in investigations with legal or regulatory implications. Creating, tuning and validating detection rules, queries and use cases to improve coverage and reduce false positives. Assessing detection gaps found during incidents and recommending improvements to logging, telemetry and controls. Developing, maintaining and ..... full job details .....