Security Operations Analyst

About this role

Security owns the safety of a platform holding identity documents, salary data and CVs across several jurisdictions.

Watch the alerts, triage what matters and escalate what is real. Most of this job is deciding quickly which of thirty alerts is worth waking someone up for.

The threat model is specific: account takeover, document forgery, automated abuse at scale, and people impersonating employers to defraud job seekers. That last one is why Trust & Safety exists as a separate function and why we work closely with it.

Primary responsibilities

• Monitor and triage security alerts across the estate, and separate the real from the noise
• Investigate suspected account takeover, credential stuffing and automated abuse — the attacks this platform actually gets
• Own detection engineering: write the rules, tune them, and retire the ones that only ever fire falsely
• Run the response to a confirmed incident: contain, evidence, communicate, and record it properly
• Hunt proactively rather than only waiting for an alert
• Work a shift pattern that keeps coverage across the working day

Skills required

Day to day this role works with Incident Response, SIEM and Log Analysis.

• One or more years in a SOC or security operations role
• Methodical under time pressure
• Two or more years in security operations or incident response
• SIEM and log analysis in practice
• Detection engineering — writing rules, tuning them and retiring the noisy ones
• Incident triage and the discipline to evidence what you found