Job Opportunities API

We are looking for an enthusiastic and detail-oriented Security Operations Analyst to join our information security and data protection team. This is an ideal opportunity for someone with experience, or in exceptional cases, someone starting their career in information security and data protection. You'll be joining a genuinely supportive team who'll back you from day one, with plenty of hands-on mentoring and real opportunities to grow. The Role: The Security Operations Analyst plays a hands-on role across day-to-day security and data protection operations, working closely with more experienced colleagues for guidance and support. Day to day, you'll be monitoring alerts and quarantines, triaging phishing reports, tracking breached credentials, and chasing up actions on our risk registers; all while contributing to KPI reporting and the policy review cycle. The ideal candidate is eager to learn and grow within the information security and data protection fields while contributing to the team’s efforts to protect our organisation's data and IT infrastructure. This is a full-time position. Occasional after-hours work may be required for incident response or urgent security tasks. Successful candidates will be enrolled on a fully funded training pathway and will be provided with mentoring support to help them grow and learn. Responsibilities: 1. Horizon scanning: Stay on top of emerging vulnerabilities, attacker techniques, and industry advisories that could affect the business Assess how anything relevant could affect our systems, applications, or third-party relationships Log significant findings and their potential impact, flagging anything high-severity to the on-duty Incident Commander Coordinate with the relevant team members and other teams to track any resulting action through to remediation Keep horizon scanning sources and subscriptions current to ensure good intelligence 2. Email triage & escalation: Manage the team’s shared inboxes, answering queries directly, and taking ownership of escalation or management where it's needed Provide security advice and guidance to users in line with good industry practice and ensure they are directed to current sources of the truth where necessary 3. Phishing triage / quarantine monitoring: Review reported phishing emails to determine true/false -positives and let the reporting user know the outcome, providing advice as needed Monitor the email quarantine, releasing legitimate email within strict SLAs, and making sure anything malicious stays blocked 4. XDR /SIEM alert monitoring: Monitor alerts from our 24x7 third-party SOC, investigate alerts as they come in, and respond to our third party according to our agreed processes and procedures Run regular health checks on our XDR to make sure agents, policies, and protections are working as they should, including effectively manage exceptions through their entire life cycle 5. Breached credential monitoring: Monitor breached credential feeds, take remedial action to secure accounts, provide advice and guidance to affected users 6. Allow-listing: Risk assess requests for allow-listing and exceptions, triaging them against business need and our risk appetite statement Apply and remove allow-listing entries in security tooling as requests come in from the business, following our agreed approval process 7. Collection and reporting of outcome driven metrics: Collate and publish routine ODMs to support security and data protection reporting to stakeholders 8. Risk register management: Log risks that are self-identified or passed for processing, ensuring the right level of data quality is present, and that the right owners and dates are assigned Review the risk register and follow up with stakeholders for entries that are reaching deadlines Risk assess and provide advice and guidance to stakeholders around risk remediation strategies based on our policies, procedures, a