Cyber Analyst in Cardiff

Responsibilities

• Monitor and triage security alerts from SIEM, EDR and cloud‑native tooling (AWS Security Hub, Guard Duty, Cloud Trail, Defender).
• Lead incident response investigations from initial triage through to root cause analysis and lessons learned.
• Maintain and improve detection rules, alerting thresholds and response playbooks.
• Participate in on‑call or escalation rota as required.
• Own the vulnerability management lifecycle, including scanning, triage, prioritisation and remediation tracking across cloud and on‑premise assets.
• Work with Engineering and Infrastructure teams to ensure timely remediation in line with agreed SLA targets.
• Produce clear, actionable vulnerability reporting for both technical and non‑technical audiences.
• Track and challenge exceptions, ensuring risk‑based decisions are documented appropriately.
• Apply security best practice across AWS (primary) and Azure environments, including IAM policy reviews, storage security, network controls, secrets management and logging coverage.
• Conduct configuration reviews and contribute to Cloud Security Posture Management tooling.
• Advise on secure design principles for new cloud workloads and architecture changes.
• Support Infrastructure and Platform teams in embedding security into Ia C pipelines and CI/CD processes.
• Contribute to the maintenance of the risk register, control evidence and policy library.
• Support internal and external audit activity, including evidence preparation, responding to findings and tracking remediation activities.
• Assist in maintaining compliance with FCA expectations, PCI DSS and relevant data protection requirements.
• Horizon‑scan for emerging threats and regulatory changes relevant to the business.
• Act as a trusted technical advisor to colleagues across TSS and the wider business.
• Contribute to the Cyber team’s strategy, roadmap and continuous improvement initiatives.
• Act as a subject matter expert, providing internal cyber security consultancy across the business.
• Support engineering squads as a trusted source of cyber security expertise.

Qualifications

• Strong hands‑on experience in a cyber security role, ideally within a regulated financial services environment.
• Strong working knowledge of AWS security services, including Guard Duty, Security Hub, Cloud Trail, IAM, Config and WAF.
• Experience operating and tuning a SIEM platform (e. g. Google Sec Ops, Sentinel).
• Demonstrable experience in vulnerability management, including tooling, triage and driving remediation alongside engineering teams.
• Hands‑on involvement in incident response processes and security investigations.
• Ability to communicate technical concepts and risks clearly to non‑technical stakeholders.
• Sound understanding of common attack techniques, with familiarity of the MITRE ATT&CK framework.
• Desirable Azure security experience, including Defender for Cloud, Entra ID and Sentinel.
• Relevant certifications such as AWS Security Specialty, Comp TIA Security+, Cy SA+, SC-200, CEH or equivalent.
• Experience within an FCA‑regulated environment and familiarity with operational resilience requirements.
• Exposure to PCI DSS, ISO 27001 or SOC 2 control frameworks.
• Scripting experience using Python, Power Shell or Bash for automation and tooling activities.
• Additional Information

Expected to attend the Cardiff office up to two times per month.

#J-18808-Ljbffr