Cyber Defence - Global Security Operations Centre (GSOC) Level 2 Analyst

As part of the Cyber Defence team in the Global Security Operations Centre, you will provide security monitoring, triage, and investigation of potential incidents. You will also help continuously improve the team's processes and ways of working to keep pace with the latest threats against the business.

Fast and effective identification and triage of potential incidents are essential to protecting our critical data and assets. You will be at the forefront of this exciting area of Cyber Security, helping protect the business and its interests every day.

You will need to have strong technical aptitude, a calm approach under pressure, excellent communication skills with both technical and non-technical audiences, and a genuine passion for security.

Key Responsibilities

• Perform investigations of security incidents, detect potential threats through log analysis, and leverage tools including SIEM, UEBA, and EDR.

• Ensure timely responses to cyber incidents to minimize the impact on the business, including collaborating with technical teams and business stakeholders where needed.

• Act as the primary escalation point for L1 analysts on complex incidents, performing investigations and root cause analysis, initiating containment actions, and collaborating with L3 analysts and other teams as required.

• Escalate high- and critical-severity incidents to the appropriate escalation team according to established processes.

• Safely acquire and preserve the integrity of cybersecurity data required for incident analysis to determine the technical and operational impact, root cause(s), scope, and nature of incidents.

• Provide process and/or technical advice and support to L1 analysts.

• Act as a shift lead, managing shift workloads to ensure incidents and tasks are appropriately assigned and handled within the shift.

• Prepare and send end-of-shift reports to leadership.

• Lead and document handover calls to ensure all updates, unassigned tickets, pending tasks, and ongoing investigations are effectively communicated to the next shift.

• Perform quality audits of tickets handled by L1 analysts to ensure incidents are managed in accordance with established processes.

• Recommend alerts for tuning to minimize false positives and improve the business's security posture against threat actors.

• Contribute to SOC process maturity and continuous improvement by creating and updating process documentation and knowledge base content, and enhancing alerts through tuning activities.

• Provide in-shift guidance, training, and mentorship to help new joiners and L1 analysts develop their operational skills.

The Requirements

• Work as part of a 24/7 SOC across multiple locations, requiring strong teamwork and the ability to collaborate with internal stakeholders and colleagues to consistently deliver exceptional service and support.

• 4–5 years of experience working as part of a mature Cyber Defence Centre or Security Operations Centre.

• Ability to troubleshoot and research security issues effectively and communicate clearly with both technical and non-technical stakeholders while maintaining professionalism.

• Strong time management skills and the ability to reliably complete assigned tasks and incidents within the shift.

• Hands-on experience using SIEM, UEBA, and EDR as a security analyst.

• Experience leading investigations and collaborating with business stakeholders to ensure thorough analysis and resolution of security alerts and incidents.

• Excellent verbal and written communication skills, with the ability to write reports using a structured methodology.

• An inquisitive mindset with a strong sense of personal responsibility for learning and self-development.

• Ability to identify common attack techniques within the context of specific technologies.

• Working knowledge of Linux, macOS, and Windows operating systems.

Beneficial

• Relevant security certifications, such as SC-200, SC-900, Security+, CySA+, CASP+, etc.

• Relevant networking certifications, such as Network+ and CCNA.

• Knowledge of other key IT fields, such as Web Application Firewalls, databases, Active Directory, data loss prevention, EDR solutions, SIEM, and network security systems including web proxies and firewalls.

WTW is an Equal Opportunity Employer.