Incidence Response Analyst

Incident Response Analyst – Hybrid (London office 1 day per month) Full-time | Cyber Security team | Hybrid, with one day a month in the London office

About the role A growing Cyber Security team is seeking an Incident Response Analyst who wants to lead investigations, not just triage alerts. You will work across a range of client environments, helping organisations contain incidents quickly and come out more resilient. You will also help shape the team’s incident response capabilities and services, so the lessons you learn on one case improve the next.

What you’ll be doing

• Triage and investigate alerts from SIEM, EDR/XDR, identity, email, cloud and network platforms, and lead or support responses to phishing, malware, account compromise and unauthorised access

• Coordinate containment, eradication and recovery with internal teams and client stakeholders, keeping clear incident records and timelines

• Collect and analyse forensic artefacts from endpoints, servers, identity, email and cloud, maintaining evidence integrity and chain of custody

• Run intelligence-led threat hunts, then tune detection rules and close gaps uncovered during investigations

• Act as a trusted advisor to clients, giving clear technical guidance, regular updates and post-incident reviews

• Improve response plans, playbooks and runbooks, and support tabletop exercises and purple-team activity

What we’re looking for

• Hands-on experience in incident response, SOC or cyber defence, investigating incidents with SIEM and EDR/XDR tools (essential)

• A solid grasp of the incident response lifecycle, and of MITRE ATT&CK, the Cyber Kill Chain and NIST frameworks (essential)

• Experience analysing Windows and Linux systems, authentication events, network traffic and security logs (essential)

• Clear written communication, from technical investigation reports to management updates

• Calm, organised delivery under pressure across several priorities

• Desirable: MSSP, consultancy or regulated-sector experience; Microsoft Sentinel and Defender; PowerShell, Python or KQL; forensic tools such as Velociraptor, Volatility or Wireshark; GCIH, GCFA, SC-200, CySA+ or CISSP

What you get

• Varied incident work across different client environments

• Competitive compensation

• Career growth opportunities

• Access to continuous learning and certifications

• Hybrid working, with just one day a month in the London office

This role suits An analyst who enjoys the pressure and detail of live investigations, and wants to turn each incident into better detection and response.