Intelligence & Analysis Officer

Cyber Security Incident Response & Threat Intelligence Analyst

wThe Cyber Security Operations Team is responsible for monitoring, detecting, and responding to cyber threats across Thomas Millers estate. We ensure the protection of digital assets and safeguard confidentiality, integrity and availability of systems. Working in a fast-paced environment, the SOC provides 24/7 vigilance, rapid incident response, vulnerability oversight and actionable threat intelligence to reduce cyber risk

.
We are seeking a Cyber Security Incident Response & Threat Intelligence Analyst to strengthen our SOC capability. The successful candidate will focus primarily on incident response while also supporting threat intelligence analysis. This hybrid role ensures we can both react quickly to active threats and proactively reduce risk exposure through continuous threat monitoring and remediation efforts. The ideal candidate will have an in-depth understanding of the overall security landscape, be experienced in cyber security incident response, with a keen ability to detect and respond to complex security incidents, tuning detection systems to spot attacker Tactics, Techniques, and Procedures (TTPs

).
They will provide technical mentorship to junior members of the team, and act as an escalation tier for complex analysis. We are looking for an individual who can balance technical risks against business risks and consistently drive for the right resul

We value broad and deep technical knowledge, specifically in the fields of operating system security, network security, software security, malware analysis, forensics, security operations, incident response, and emergent security intellig

litiesRespond to and investigate cyber security incidents, including malware outbreaks, phishing attempts, insider threats and handle digital fore
Continuously improve our monitoring systems' detection and response capabilities as well as processes, procedures, and pla
identsAutomate analysis and response steps to reduce manua
Utilise Microsoft security tools such as Microsoft Defender for Endpoint, Microsoft 365 Defender, and Azure Security Centre to detect, respond to, and mitigate security inci
Perform root cause analysis to determine how breaches or incidents occurred and implement long term prevention strat
Conduct post-incident analysis to identify areas for improvement and lessons le
Maintain detailed records of security incidents, including incident timelines, analysis, and resolu
Plan and execute monitoring system architectural c
iencesRecognise, adopt and install the best practices in security engineering fields throughout the organisation: development, cryptography, network security, security operations, incident response, security intelli
Gather, analyse and disseminate threat intelligence from internal and external so
Provide intelligence driven recommendations for improved SOC detection and con

Familiarity with threat intelligence platforms (e.g., Recorded Future, ThreatConnect, Man
Splunk, IBM QRadar, ArcSight,
Rapid7)Threat Intelligence Platforms (e.g., onnect)Firewalls and Network Monitoring tools (e.g., hantom)Experience with Web Gateway and Web Proxy tools (e.g., o Alto)Strong knowledge of operating systems (Windows, Linux) and network pro
Familiarity with scripting languages such as Python, Bash, or Powe
Experience with cloud security monitoring (AWS, Azure
, icationsBachelor’s Degree in Cyber Security, Information Technology, or a relate
d field.3-5 years of experience in SOC Operations, incident response, threat intelligence, or similar roles within a SOC envi
In depth knowledge of networking, security principles, and threat detection method
Practical experience in network- and host-based digital forensics across multiple operating
systemsIn-depth experience working with a variety of monitoring tools, including SIEM, endpoint security, intrusion detection/prevention, packet a
and SOARKnowledge of open security testing standards and projects, including OWASP and the MITRE ATT&C
English.
Experience with forensic investigations, malware analysis and reverse eng
Familiarity with regulatory frameworks (e.g., Experience leading the deployment of a major SIEM platform (Splunk, QRadar, Sentinel, ArcSight, etc) and/or EDR platform (Crowdstrike, Defender for Endpoint, Cyla
nce, etc)5+ years of experience in cyber security and adjacent fields such as systems engineering, network management, cloud security, and/or application
position2+ years of scripting/coding experience with one or more
languagesRelevant industry certifications, a degree in cyber security or adjacent fields, or cyber security b
oot campsExperience in python, powersh
terraformFamiliarity with cloud platforms like AWS, Azu