Senior Security Operations Analyst

About the Role

We are looking for a Senior Security Operations Analyst to serve as our primary operational anchor for EMEA, bridging follow-the-sun operations across global time zones (APAC and the Americas). In this role, you will analyse security events, investigate potential threats, validate and manage high-priority incidents, and execute decisive containment actions to minimise overall impact while escalating unresolved incidents to security engineering teams.

This person will monitor and remediate security incidents across on-prem, identity, and cloud-based environments for internal corporate infrastructure and enterprise client engagements. As the primary responder on shift during EMEA business hours, you should possess deep operational muscle memory, strong technical composure under pressure, and the initiative to challenge assumptions and propose continuous improvements. This is a remote role from either the UK, Ireland, or Poland. 

Responsibilities:

• Lead triage, scoping, containment, and eradication for medium-to-high severity security incidents across endpoint, identity, SaaS, and cloud environments.
• Perform deep-dive investigations, threat isolation, and query hunting leveraging CrowdStrike Falcon (Host Timeline, Real Time Response).
• Investigate identity compromises, phishing campaigns, and suspicious account activities using Google Admin Console (Investigation Tool, Email Log Search, Token Auditing).
• Analyse ingress edge telemetry, CDN traffic patterns, WAF events, and web server logs (including Cloudflare and Acquia application environments) to detect, trace, and mitigate web attacks, DDoS conditions, and botnet/scraping abuse.
• Maintain and continuously update incident response plans and runbooks for efficient incident response, collaborating with engineering to automate containment workflows.
• Coordinate cross-departmental remediation tasks and escalate unresolved incidents with clear technical root-cause analysis (RCA) aligned with MITRE ATT&CK.
• Collaborate with content production for security awareness and mentorship.

About You

The essentials:

• 5+ years of direct experience in Security Operations (SOC), Incident Response, or similar hands-on technical operational roles.
• Bachelor’s degree in Computer Science/Engineering/Information Security, or equivalent practical experience.
• Deep operational experience utilising CrowdStrike (investigation workflows, Host Timeline, Real Time Response, and query hunting).
• Proven experience leveraging Google Admin Console (Investigation Tool, Email Log Search, Token Auditing) for phishing, BEC, and identity investigations.
• Hands-on experience with industry-leading security tools across EDR, SWG, SIEM, and MDM platforms.
• Solid understanding of network protocols, traffic flow, and the OSI model.
• Experience with log analysis, malware triage, and digital forensics.
• Proven track record of operating autonomously during incidents with minimal supervision.
• Practical experience leveraging AI tools, LLMs, or agentic workflows to assist analysis, scripting, or automation.
• Working ITIL knowledge and functional familiarity with the MITRE ATT&CK framework.
• Courteous, articulate, and educated in interpersonal delivery. Maintains a polite, respectful, and calm demeanor with internal teammates, leadership, and external clients even during incident bridges.
• Ability to confidently and politely present findings to technical and non-technical stakeholders.
• Self-directed, resourceful, and critical thinker with proactive problem-solving instincts.
• Strong personal anxiety management and self-organisation during high-pressure incidents.
• Eager to learn, experiment with emerging tooling, and actively suggest process enhancements.

Not a must, but a plus:

• Demonstrated hands-on and reflexive triage/containment instincts over theoretical knowledge or paper certifications (certifications like CISSP, Sec+, or CEH are welcome, but secondary to proven live-fire execution).
• Experience analysing Cloudflare edge/WAF logs and Acquia/Drupal web server access logs for application-layer anomalies, scraping, and volumetric spikes.
• Hands-on experience with modern SIEM / SecOps platforms:
• Cloud security experience (GCP, AWS, Azure) in production environments.
• Scripting proficiency (Python, PowerShell, Bash) for automated triage and API data collection.
• Exposure to Blue/Red/Purple team simulation exercises.

#LI-RE1 #LI-Hybrid