Senior Security Analyst job description

Cybersecurity — Senior Security Analyst
Investigates and closes incidents independently end to end.

RESPONSIBILITIES
- Coordinate a multi-system incident across several teams and decide when to escalate and who the law requires you to notify.
- Plan the recovery order for critical systems and run a recovery exercise that tests the agreed recovery targets.
- Pull extra evidence from other tools to triage alerts, including insider misuse such as unusual access or bulk data copying.
- Write a simple detection rule from a described behavior, test it against sample data, and adjust it when it fires too often.
- Fix parsing faults in a log source, tune a noisy rule without losing coverage, and report retention gaps against what detections need.
- Collect evidence from a single system, maintain a chain of custody record, and identify obviously suspicious artefacts.

REQUIREMENTS
- Experience at the Security Analyst level (level 1 of 5) or equivalent
- Holds CompTIA Security+

REQUIRED SKILLS
Threat Operations
- Security Alert Triage — You can pull extra evidence from other tools to triage alerts, including insider misuse such as unusual access or bulk data copying.
- Threat Detection Engineering — You can write a simple detection rule from a described behavior, test it against sample data, and adjust it when it fires too often.
- SIEM Monitoring and Tuning — You can fix parsing faults in a log source, tune a noisy rule without losing coverage, and report retention gaps against what detections need.
- Incident Response Coordination — You can coordinate a multi-system incident across several teams and decide when to escalate and who the law requires you to notify.
- Digital Forensics and Evidence Handling — You can collect evidence from a single system, maintain a chain of custody record, and identify obviously suspicious artefacts.
- Threat Intelligence Analysis — You can check the environment against indicators from a report, and flag matches for investigation.

Exposure Management
- Vulnerability Scanning and Triage — You can design a scanning scope and cadence for a new environment, and correlate findings across tools to avoid duplicate or contradictory severity ratings.
- Vulnerability Remediation Coordination — You can track remediation against agreed timelines for findings you own, and escalate ones that are about to breach their deadline.
- Penetration Testing and Exploitation — You can follow a test plan to run known tools against an agreed target and record what each one reports.
- Cloud Security Posture Management — You can fix a straightforward misconfiguration, such as an open storage bucket or an over-permissive rule, once it has been flagged to you.
- Asset Inventory and Attack Surface Management — You can scan known ranges and record each asset found in the inventory, with exposed services that should not be reachable marked.
- Secure Configuration and Hardening — You can apply an approved baseline to a system and record each exception and its owner, with a reviewer checking the record.

Resilience
- Cyber Resilience and Recovery — You can plan the recovery order for critical systems and run a recovery exercise that tests the agreed recovery targets.

Identity and Access
- Identity and Access Governance — You can run a periodic access review for a system you support, and chase down owners who have not responded.
- Privileged Access Management — You can administer the privileged access tooling day to day, onboarding accounts, setting session recording and rotating credentials to the agreed schedule. You spot when a request asks for more reach than the task needs and say so.
- Identity Federation and Single Sign-On — You can configure a straightforward single sign-on connection from a documented pattern and test that a user can sign in, with an engineer reviewing the settings before they go live.

Secure Architecture
- Security Architecture Design — You can produce the security section of a design for a small system by following an existing pattern, and explain each control you included when an architect reviews it.
- Threat Modeling — You can run a threat model for a single application using an agreed method, record the threats found and link each one to a control or an accepted risk.
- Application Security Testing — You can test an application yourself with both scanner and manual technique, confirm a finding is genuinely exploitable, and describe the reproduction steps clearly enough to fix.
- Secure Code Review — You can review a feature in a language you work in, trace user-controlled data to where it is used, and explain the fix to the author.
- Security Requirements and Design Review — You can check a proposed design against a requirements checklist and write up what is missing, with a senior reviewer deciding what actually blocks approval.

Governance and Risk
- Security Risk Assessment — You can assess a contained risk using the agreed method, describe the impact in terms the system owner recognizes, and propose treatment options.
- Security Policy Management — You can apply agreed edits to policy documents and log each change, with an owner reviewing what you produce before it is published.
- Supply Chain and Third-Party Security Risk — You can send out a supplier security questionnaire, chase the response and summarize the answers, with a reviewer deciding what the gaps actually mean.
- Security Awareness Program Management — You can run a scheduled awareness campaign or phishing simulation yourself, brief the managers affected and handle the reports that come back from staff.
- Security Metrics and Reporting — You can maintain a reporting pack, explain what each metric counts and where it comes from, and answer questions about a movement in the figures.
- Security Control Testing and Assurance — You can test a single control against its stated requirement and report any gap to the control owner.

Delivery
- Project Management — You can organize a small piece of work into steps, put them in a sensible order, and finish it by the date you agreed, raising problems before they cause a delay.
- Planning & Estimation — You can estimate your own work with reasonable accuracy and keep a steady enough pace that other people can plan around you.
- Ownership & Accountability — You can pick up a problem that has no obvious owner and make yourself accountable for it, including the parts nobody enjoys.
- Quality Focus — You can define what good enough means for a project, put checks in place to show it has been met, and hold work back when it falls short.

Craft
- Problem Solving — You can break a large, ambiguous problem into pieces and weigh the options for each against the evidence.
- Domain Expertise — You can work confidently with the tools and methods your team uses daily, and you can explain how your work serves the team's goals.
- Continuous Learning — You can pick up an unfamiliar area fast enough to be useful in it, and you turn what you learned into something others can reuse.

Communication
- Communication — You can explain a complex topic to people with very different backgrounds, adjusting the detail to the audience without talking down to them.
- Collaboration — You can build working relationships beyond your own team and get things done through people who do not report to you.
- Writing & Documentation — You can write for a defined audience, whether a proposal, a policy, a report, or a decision record, and make the reasoning as clear as the conclusion.
- Stakeholder Management — You can identify who is affected by your work and keep them updated at a level of detail and a frequency that suits them.

Leadership
- Leadership — You can spot a problem and propose a way forward unprompted, and you take a small leading role such as running a working group.
- Mentoring — You can help someone new settle into your team's work, answer their questions patiently, and give feedback specific enough to act on.
- Strategic Thinking — You can connect your team's work to its goals and question a task that does not appear to serve them.

REQUIRED CERTIFICATIONS
- CompTIA Security+ (required from Senior Security Analyst)