SOC Analyst

About This Role

This SOC Analyst role is an integral part of the team's success, reporting to the Director of Info Sec and Cyber Operations. As a security operations center engineer, you will help build and manage services that detect and automate the mitigation of cybersecurity threats across Waystone infrastructure. You will collaborate with various internal teams to protect Waystone.

Responsibilities

• Monitor and analyse security alerts from various sources, including AWS, Azure, O365, Okta, Zscaler and SIEM tools, to identify potential security threats
• Perform incident detection, analysis, and response for cloud-native environments, utilizing Security Hub (AWS) and Defender for Cloud (Azure)
• Collaborate with internal teams to address security incidents and ensure timely resolution, including coordination with IT, Security Engineering, and other stakeholders
• Develop and refine security monitoring policies, rules, and alerting configurations for enhanced detection capabilities
• Conduct investigations into security incidents, identifying root causes and recommending remediation steps
• Maintain and optimise DLP solutions for the organisation to prevent unauthorised data exposure
• Generate regular reports on security incidents, key metrics, and recommendations for security improvements
• Proactively identify security risks and work with various teams to mitigate potential threats
• Participate in threat hunting activities to identify advanced threats and vulnerabilities within the cloud and on-premises environments
• Provide input into the SOC’s continuous improvement processes, including playbook development and toolset enhancement

Requirements

• 3+ years of experience in a Security Operations Centre (SOC) or similar environment
• Hands-on experience with AWS, Azure, Zscaler and O365 security tools and technologies
• Strong familiarity with cloud native tools, cloud security posture management, and application security (Security Hub, Defender for Cloud)
• Experience with SIEM platforms (CrowdStrike NG-SIEM or similar) including alert tuning, query development, and integration with cloud environments
• Proficient in data loss prevention (DLP) strategies and tools, with the ability to customise and maintain DLP policies
• Strong understanding of incident response processes and best practices
• Demonstrated ability to conduct thorough investigations and report on complex security incidents
• Familiarity with cloud security principles, tools, and techniques, including identity and access management (IAM) and network security
• Strong problem-solving skills, attention to detail, and ability to work under pressure in a fast-paced environment
• Bachelor’s degree in information security, Computer Science, or related field (or equivalent work experience)