Information Security Analyst in London

Fuse Energy is a forward-thinking renewable energy startup on a mission to deliver a terawatt of renewable energy - fast. We’re combining first-principles thinking with cutting-edge technology to build a radically better energy system.

We are looking for a hands-on and technically skilled Information Security Analyst to keep Fuse secure at full speed. You will sit within the team that owns security across our IT and cloud environment, spanning AWS infrastructure, identity providers, endpoints, SaaS applications, and our data centre environments; acting as the security escalation point for IT so the business can focus on building the future of energy. The ideal candidate is a problem-solver who thrives in a fast-paced environment and is comfortable owning issues end-to-end, from investigating a compromised account to automating the repetitive parts of triage and response.

Responsibilities

• Act as an escalation point for IT in areas such as IAM, security, and automation
• Act as the security AI champion, building tools to make everyone's jobs easier
• Own security monitoring end-to-end: build and tune log pipelines from AWS (CloudTrail, GuardDuty, VPC Flow Logs), endpoints, identity providers, SaaS audit logs, and network infrastructure into a coherent detection stack
• Write, test, and maintain detection rules that reduce noise and measure coverage against real attacker behaviour
• Lead incident response from detection through containment, eradication, and post-mortem; own the IR runbooks and keep them tested through tabletop exercises
• Perform forensic analysis on compromised endpoints, cloud workloads, and accounts, preserving evidence properly when it matters
• Work with IT to develop and improve security and IT policies and documentation
• Act as the point of contact for the business on external audits and assessments
• Track threat intelligence relevant to energy, trading, and GPU infrastructure and turn it into detections and hunts
• Run vulnerability management from a threat-led angle: prioritise by exploitability and exposure, and drive remediation through the IT and engineering teams who own the fixes
• Monitor the security of our data centre environments (firewall logs, OOB access, east-west traffic) and flag anything that breaks the segmentation model
• Feed findings back into prevention by working with IT and engineering to close root causes

Requirements

• Background in IT, SOC operations, or other hands-on technical work
• Solid grasp of cloud infrastructure, ideally AWS
• Strong networking knowledge: can read a PCAP, spot beaconing in flow logs, and reason about lateral movement across VLANs and firewalls
• Knows attacker tradecraft (initial access, persistence, privilege escalation, exfiltration) and can map an investigation to it
• Comfortable scripting in Python or similar to automate enrichment, triage, and response
• Strong ownership mindset: sees things through end-to-end with little guidance

Desirable

• Deep familiarity with an EDR platform (CrowdStrike, SentinelOne, Defender) as an investigation tool
• Detection-as-code experience (Sigma, detection rules in Git, CI-tested detections)
• SOAR or custom automation for response workflows
• Experience defending data centre or colocation environments (OOB networks, BMC/IPMI, physical access telemetry)
• Experience handling security audits (ISO27001 or SOC2)
• Familiarity with FortiGate logging and NetFlow/sFlow analysis
• DFIR certifications such as GCIH, GCFA, or GCIA are useful but not required
• Experience in energy, fintech, trading, or another high-value-target environment

Benefits

• Biannual bonus scheme
• Fully expensed tech to match your needs
• Paid annual leave
• Breakfast and dinner allowance for office-based employees