Cyber Security Analyst

We are looking for a proactive and technically capable Cyber Security Analyst to join our Security Operations team. In this role, you will be responsible for detecting, investigating, and responding to security incidents across a diverse technology estate spanning both cloud and on‑premise environments. Reporting to the Security Operations Lead, you will strengthen our detection and response capabilities through the development of high‑quality detections, improvement of playbooks, and post‑incident reviews to drive continuous improvement. You will work closely with technical and non‑technical stakeholders across the business, requiring strong communication skills and the ability to translate complex security concepts into clear, actionable insights. The role includes participation in an on‑call rota for high‑severity incident response.

Responsibilities

• Proactively monitor and analyse security events to detect and respond to potential threats
• Investigate alerts and incidents, performing triage, containment, and remediation activities
• Develop, implement, and tune detection use cases aligned to frameworks such as MITRE ATT&CK
• Correlate data from multiple sources (endpoint, identity, network, and cloud) to identify suspicious behaviour
• Build and maintain dashboards, alerts, and reports to improve security visibility
• Conduct proactive threat hunting based on threat intelligence and behavioural patterns
• Develop and maintain incident response playbooks, continuously improving them based on emerging threats and lessons learned
• Perform post‑incident reviews to identify root causes and implement preventative measures
• Tune alerts and detections to reduce false positives and improve signal‑to‑noise ratio
• Contribute to the ongoing improvement and management of security tooling and processes

Required Skills and Experience

• Proven experience monitoring, investigating and responding to security incidents across enterprise environments
• Hands‑on experience with SIEM platforms such as Splunk, including detection engineering, alert tuning, and dashboard creation
• Experience with endpoint detection and response tools such as Microsoft Defender for Endpoint or similar
• Strong understanding of common attack techniques, tactics, and procedures (TTPs), ideally mapped to MITRE ATT&CK
• Experience analysing logs across multiple domains (endpoint, identity, network, cloud)
• Familiarity with SOAR platforms and automation
• Experience working within security frameworks such as PCI DSS, ISO 27001, or similar
• Strong analytical and problem‑solving skills with the ability to work independently
• Excellent communication skills, with the ability to clearly articulate security risks to non‑technical audiences

Desirable Experience

• Experience in threat hunting and behavioural‑based detection
• Experience reducing false positives and improving detection quality in a SOC environment
• Scripting or automation experience
• Understanding of web application security and common attack vectors

Benefits

• Hybrid working (2‑3 days in the office at a minimum)
• 24 days holiday (+ 8 bank holidays)
• Annual bonus scheme
• Enhanced maternity and adoption leave
• Company pension with up to 8% N Brown contribution
• Mental Health support both internally and externally, including access to wellbeing champions and counselling services
• A range of financial wellbeing support
• Stream – a financial wellbeing tool that helps you track your pay, access earnings early and manage your money with confidence
• Colleague discount across all N Brown brands
• Onsite café with subsidised rates and local restaurant discounts
• Life Assurance and Private Medical Insurance
• Paid volunteer time – all colleagues can take a full day paid to volunteer for a charity of their choice

Equal Opportunity Statement

We are an equal opportunity employer and value diversity. We do not discriminate based on race, religion, colour, national origin, sex, gender, gender expression, sexual orientation, age, marital status, veteran status, or disability status.