Lead Simulation and Exercise Technical Analyst

Lead Simulation and Exercise Technical Analyst

📍 Sheffield

Join the Incident Management & Response function within Global Cybersecurity Operations (GCO) as a Lead Simulation and Exercise Technical Analyst — a hands-on technical role building the automated tooling and solutions that power HSBC-style cyber exercising. You'll design technical resources, develop automation primarily using Splunk SIEM and Phantom SOAR, and help ensure People, Process, and Technology are ready to face real cyber incidents.

What you'll do:

• Lead the design and development of technical resources supporting staff exercising
• Design and build automated solutions to complex problems, primarily using Splunk SIEM and Phantom SOAR
• Provide input into new technology deployments for simulations and exercises
• Liaise between operational teams and partners to drive improvement based on exercise outputs
• Support Simulation & Exercise Analysts in creating simulations and exercises
• Work with third parties to improve technical solutions for simulations and exercises
• Research emerging threats and vulnerabilities to inform automated detection/response
• Contribute to the evolution of hunting, monitoring, detection, analysis, and response capabilities
• Train, develop, and mentor colleagues in your area(s) of specialism

What you'll bring:

• 3+ years' experience in a cybersecurity analyst or senior software development role
• Excellent knowledge and demonstrated experience in Python and SQL (or similar)
• Experience working with complex cross-domain/cross-product designs
• Experience managing change and deployments impacting a global team at enterprise scale
• Good knowledge of cybersecurity technologies: IDS/IPS/HIPS, anti-malware, firewalls, proxies, MSS
• Good knowledge of incident response tools, techniques, and processes
• Familiarity with security frameworks/standards: NIST, ISO2700x, OWASP, PCI DSS, FFIEC, GLBA
• Experience with cloud platforms (AWS, Azure, GCP)
• Strong problem-solving, communication, and stakeholder-relationship skills
• Experience in an enterprise-scale organisation, ideally in finance or a similarly regulated sector

Nice to have : Formal education/advanced degree in Information Security, Cybersecurity, Computer Science, or equivalent demonstrated experience.

Ideal for : a technically strong cybersecurity engineer/analyst who enjoys building automation and tooling (Splunk, SOAR) behind the scenes to make security exercising realistic, rather than running the stakeholder-facing side of exercises.