Overview: The Security Analyst II is responsible for investigating and responding to complex, escalated, or high-impact cybersecurity events within a 24/7 Security Operations Centre (SOC). The role involves analysing security activity across multiple technology domains, correlating available evidence, determining the scope and potential impact of incidents, and supporting appropriate response and remediation actions.
In addition to managing assigned investigations, the Security Analyst II serves as an on-shift technical escalation point for Security Analyst I, providing guidance on complex cases and supporting timely decision-making. The role requires strong investigative judgement across areas such as phishing, account compromise, malware, and potential data exposure, while ensuring investigations are properly documented, progressed, and handed over between operational shifts.
The position operates within a 24/7 Security Operations Centre, and candidates should be comfortable working rotational shifts, including nights, weekends, and public holidays.
Principal Responsibilities
Monitoring and Analysis:
- Support a 24x7 Global Security Operations Centre (SOC) environment by responding to security events in the environment.
- Maintain visibility across the active alert queue and support timely investigation and resolution of security events.
Incident Triage and Response:
- Lead the investigation and response of higher-impact or complex security incidents.
- Assess the scope, severity, and potential business impact of suspicious activity.
- Recommend and coordinate appropriate containment, remediation, and escalation actions in accordance with established procedures.
- Collaborate with incident response and relevant internal teams to support effective incident handling.
Alert Investigation:
- Investigate and analyse alerts generated by security tools (EDR, NDR, SIEM) to identify potential security incidents.
- Correlate available evidence to develop investigation hypotheses, construct timelines, and identify potentially affected users or systems.
- Document investigation findings and provide detailed reports.
Technical Escalation and Analyst Support:
- Serve as an on-shift technical escalation point for junior analysts handling complex or unfamiliar security events.
- Review escalated investigations for completeness and accuracy and provide guidance on additional investigative steps.
- Communicate technical findings, security risks, and required actions clearly to relevant stakeholders.
- Support the coordination of evidence gathering, containment, remediation, and recovery activities.
Shift Handover and Collaboration:
- Provide structured handovers of ongoing investigations between Security Operations Centre shifts.
- Review and accept cases transferred from previous shifts.
- Maintain appropriate ownership of investigations until resolution, escalation, or formal handover.
Security Documentation and Process Improvement:
- Contribute to the development and maintenance of security documentation, procedures, playbooks, and incident response plans.
- Identify recurring false positives, detection gaps, and operational inefficiencies.
- Recommend improvements to security monitoring, investigation, and escalation processes.
Continuous Learning:
- Stay current with emerging threats, vulnerabilities, and industry best practices.
- Participate in training and development programmes to enhance skills and knowledge.
Work Experience:
- 3+ years of relevant experience in security operations, incident response, threat detection, or a comparable cybersecurity function.
- Demonstrated experience independently investigating security incidents, handling escalations, and supporting incident response activities.
- Prior experience working in a 24x7 or shift-based Security Operations Centre environment is strongly preferred.
- Equivalent practical experience may be considered where the required technical and investigative capability is clearly demonstrated.
- Experience working within globally distributed teams and collaborating effectively across cultures, regions, functions, and time zones.
- Collaborative and team-oriented approach, with the ability to work effectively with Security, Engineering, Product, Infrastructure, GRC, Privacy, Legal, and other business stakeholders.
- Intermediate-level cybersecurity certifications such as AZ-500, CySA+, GSOC, or GCIA are an added advantage.
- Excellent analytical and problem-solving abilities.
Education and Skills:
- Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or a related field, or equivalent practical experience demonstrating comparable knowledge and job skills.
- Strong understanding of cybersecurity principles, security monitoring, incident response, and security operations processes.
- Strong understanding of common cybersecurity threats, vulnerabilities, attack techniques, and adversary behaviour, with the ability to apply this knowledge during investigations.
- Proficient in security monitoring and investigation techniques, with the ability to independently analyse alerts, correlate evidence, and determine appropriate response or escalation actions.
- Strong written and verbal communication skills in English, with the ability to communicate investigation findings, risks, status, and required actions clearly to both technical and non-technical stakeholders.
Preferred Qualifications:
- Experience with proactive threat hunting or advanced threat analysis.
- Previous experience acting as an Incident Coordinator, Incident Commander, or security incident lead is highly desirable.
- Familiarity with scripting or automation for security analysis and operational efficiency.
- Experience contributing to post-incident reviews, root-cause analysis, or lessons-learned activities.
- Familiarity with phishing investigation and advanced threat intelligence analysis.
- Experience contributing to security playbooks, procedures, or process-improvement initiatives.
The above statements are intended to describe the general nature and level of work being performed. They are not intended to be construed as an exhaustive list of all responsibilities, duties, and skills.
