Security Operations Analyst in Birmingham

We are looking for an enthusiastic and detail-oriented Security Operations Analyst to join our information security and data protection team. This is an ideal opportunity for someone with experience, or in exceptional cases, someone starting their career in information security and data protection. You'll be joining a genuinely supportive team who'll back you from day one, with plenty of hands-on mentoring and real opportunities to grow.

The Security Operations Analyst plays a hands-on role across day-to-day security and data protection operations, working closely with more experienced colleagues for guidance and support. Day to day, you'll be monitoring alerts and quarantines, triaging phishing reports, tracking breached credentials, and chasing up actions on our risk registers; all while contributing to KPI reporting and the policy review cycle. The ideal candidate is eager to learn and grow within the information security and data protection fields while contributing to the team’s efforts to protect our organisation's data and IT infrastructure.

This is a full-time position. Occasional after-hours work may be required for incident response or urgent security tasks. Successful candidates will be enrolled on a fully funded training pathway and will be provided with mentoring support to help them grow and learn.

Responsibilities:

• Horizon scanning: Stay on top of emerging vulnerabilities, attacker techniques, and industry advisories that could affect the business. Assess how anything relevant could affect our systems, applications, or third-party relationships. Log significant findings and their potential impact, flagging anything high-severity to the on-duty Incident Commander. Coordinate with the relevant team members and other teams to track any resulting action through to remediation. Keep horizon scanning sources and subscriptions current to ensure good intelligence.
• Email triage & escalation: Manage the team’s shared inboxes, answering queries directly, and taking ownership of escalation or management where it's needed. Provide security advice and guidance to users in line with good industry practice and ensure they are directed to current sources of the truth where necessary.
• Phishing triage / quarantine monitoring: Review reported phishing emails to determine true/false positives and let the reporting user know the outcome, providing advice as needed. Monitor the email quarantine, releasing legitimate email within strict SLAs, and making sure anything malicious stays blocked.
• XDR /SIEM alert monitoring: Monitor alerts from our 24x7 third-party SOC, investigate alerts as they come in, and respond to our third party according to our agreed processes and procedures. Run regular health checks on our XDR to make sure agents, policies, and protections are working as they should, including effectively manage exceptions through their entire life cycle.
• Breached credential monitoring: Monitor breached credential feeds, take remedial action to secure accounts, provide advice and guidance to affected users.
• Allow-listing: Risk assess requests for allow-listing and exceptions, triaging them against business need and our risk appetite statement. Apply and remove allow-listing entries in security tooling as requests come in from the business, following our agreed approval process.
• Collection and reporting of outcome driven metrics: Collate and publish routine ODMs to support security and data protection reporting to stakeholders.
• Risk register management: Log risks that are self-identified or passed for processing, ensuring the right level of data quality is present, and that the right owners and dates are assigned. Review the risk register and follow up with stakeholders for entries that are reaching deadlines. Risk assess and provide advice and guidance to stakeholders around risk remediation strategies based on our policies, procedures, and risk appetite statement. Escalate to the on-duty incident commander when timelines may be breached, or when proposed risk acceptances exceed established tolerance levels.
• Policy review initiation: Initiate document reviews for policies, procedures, processes, standards, and guidance before they're due for review. Collate feedback and resolve alone where able, then work collaboratively with subject matter experts to resolve more complex matters. Ensure current versions are kept up to date and are available to all employees through the right channels.
• Client assurance & contracts: Complete client security questionnaires and RFIs, drawing on our policies, certifications, and control evidence. Review contracts for security clauses, flagging anything that sits outside our standard position for review. Complete Data Processing Agreements (DPAs) and track them through to sign-off with the relevant stakeholders.

Requirements:

• Level 4 qualification in Information Technology or a related field, or equivalent experience.
• 0-3 years of experience in cyber security or a related IT role, 2 or more years is preferred.
• CompTIA Security+, Cisco CCNA, CISMP, or other security certifications are preferred.
• Membership with the Chartered Institute of Information Security or equivalent bodies is essential.
• Familiarity with security concepts, tools, and technologies, including an understanding of network security and operating systems.
• A working knowledge of UK and EU data protection law (UK GDPR, the UK Data Protection Act 2018, and EU GDPR).
• Willingness to learn and grow in the cyber security and data protection field.
• Ability to work autonomously and manage multiple tasks simultaneously.
• Strong analytical, investigative, and problem-solving abilities.
• The adaptability to do a range of work, sometimes complex and non-routine, in different environments.
• The ability to work proactively, use discretion, and determine when to escalate issues.
• Strong written and verbal communication skills, with the ability to interact effectively with both technical and non-technical stakeholders at all levels of our organisation.

Benefits:

• Time off that works for you — 25 days' holiday + bank holidays, a paid Wellbeing Day, flexible bank holidays to honour cultural or religious observances, and the option to buy or carry over up to 5 extra days.
• Flexibility & lifestyle — Smart Working with up to 40% from home, and after 12 months, the option to work from abroad for up to 90 days a year.
• Family & life milestones — Enhanced family friendly leave, 3 extra days for your wedding/honeymoon, and an Employee Assistance Programme whenever you need support.
• Financial perks — Pension scheme, Corporate Medical Cash Plan, electric car salary sacrifice scheme, and tax-efficient payroll giving to your favourite charities.
• Growth & recognition — Funding for professional qualifications, monthly Employee of the Month awards (£250 bonus), and referral bonuses of up to £1,500.
• Community & wellbeing — Regular Wellbeing Workshops, 30+ Wellbeing Champions, a paid Volunteer Day, and an online perks platform with discounts on top brands, days out, and gym memberships.

We Value Diversity: We champion and welcome diversity in our workforce and ensure all job applicants receive equal and fair treatment, regardless of age, race, gender or gender identity, religion, sexual orientation, disability, or nationality. We are not only committed to increasing the visibility and recognition of talent from under-represented groups within our organisation, but the wider industry too. At the end of the day, we make sure we take time to look after ourselves, each other, and the planet, because we’re always stronger together. ITG have a number of community groups available to employees and exist to offer a safe space for like-minded colleagues, with shared interests to connect, socialise and check in with each other.

What next? If you found yourself interested in knowing more, drop us your application and someone from our team will be in touch.