Overview
As an Incident Response Analyst, you will join the Cybersecurity Operations team to protect colleagues and customers from evolving threats. You will investigate alerts, coordinate containment, and document actions while collaborating with cross-functional teams. The role supports an AI-enabled SOC, driving faster triage, investigation, and learning from incidents. You help mature detections, playbooks, and response processes to reduce risk at scale. This position blends hands-on investigation with project work to strengthen security capabilities.
Responsibilities
- Monitor, assess, prioritize, and investigate security alerts and incidents using security telemetry and threat intelligence
- Escalate when specialist expertise is required
- Investigate confirmed malicious activity across endpoints, identity, network, cloud, and other data sources
- Execute or coordinate approved containment actions
- Maintain thorough incident timelines and investigative notes with evidence and decisions
- Collaborate with peer responders, threat intelligence, detection engineering, and broader teams
- Participate in post-incident reviews and drive improvements to detections, playbooks, telemetry, and processes
- Utilize AI-enabled security capabilities to accelerate triage, investigation, response, and documentation
- Identify opportunities to automate IR activities or incorporate AI-enabled workflows
- Support development of AI-enabled security capabilities
Key requirements
- Knowledge of cybersecurity, security operations, and incident response
- Understanding of threat actor TTPs
- Familiarity with enterprise technologies and tools (SIEM, EDR/XDR/NDR, identity, cloud, security orchestration)
- Strong analytical skills with evidence-based conclusions from logs and telemetry
- AI literacy, including generative AI concepts and limitations
- Curiosity and willingness to learn new skills
- Experience in SOC/IR or AI-enabled security tooling preferred
- Security certifications such as Security+, CySA+, GCIH, GCIA, GSOC
- curiosity
- collaboration
- strong communication
- SIEM
- EDR/XDR/NDR
- identity security
Associate-CyberOps & Assurance employer: American Express
American Express is an exceptional employer located in Burgess Hill, West Sussex, offering a dynamic hybrid work environment that fosters innovation and collaboration. With a strong focus on employee growth, mentorship, and cutting-edge technology, team members are empowered to develop their skills in AI and engineering while contributing to meaningful projects that shape the future of commerce. The inclusive work culture values every voice, ensuring that your contributions have a real impact on both customers and the community.
