Cybersecurity Analyst II

• Investigate and respond to complex, escalated, or high-impact cybersecurity events within a 24/7 Security Operations Centre
• Analyse security activity across multiple technology domains, correlate evidence, determine incident scope and potential impact, and support response and remediation
• Serve as an on-shift technical escalation point for Security Analyst I and guide complex investigations
• Support a 24x7 Global Security Operations Centre by responding to security events and maintaining visibility across the active alert queue
• Lead investigations and responses for higher-impact or complex security incidents
• Assess scope, severity, and potential business impact of suspicious activity
• Recommend and coordinate containment, remediation, and escalation actions
• Collaborate with incident response and relevant internal teams
• Investigate and analyse EDR, NDR, and SIEM alerts
• Develop investigation hypotheses, construct timelines, and identify affected users or systems
• Document findings and provide detailed reports
• Review escalated investigations for completeness and accuracy and guide additional investigative steps
• Communicate technical findings, security risks, and required actions to stakeholders
• Coordinate evidence gathering, containment, remediation, and recovery activities
• Provide structured handovers between Security Operations Centre shifts
• Review and accept cases transferred from previous shifts and maintain ownership through resolution, escalation, or handover
• Contribute to security documentation, procedures, playbooks, and incident response plans
• Identify false positives, detection gaps, and operational inefficiencies and recommend process improvements
• Stay current with emerging threats, vulnerabilities, and industry best practices
• Participate in training and development programmes

• 3+ years of relevant experience in security operations, incident response, threat detection, or a comparable cybersecurity function
• Demonstrated experience independently investigating security incidents, handling escalations, and supporting incident response activities
• Prior experience working in a 24x7 or shift-based Security Operations Centre environment is strongly preferred
• Equivalent practical experience may be considered where the required technical and investigative capability is clearly demonstrated
• Experience working within globally distributed teams and collaborating across cultures, regions, functions, and time zones
• Ability to work effectively with Security, Engineering, Product, Infrastructure, GRC, Privacy, Legal, and other business stakeholders
• Intermediate-level cybersecurity certifications such as AZ-500, CySA+, GSOC, or GCIA are an added advantage
• Excellent analytical and problem-solving abilities
• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or a related field, or equivalent practical experience demonstrating comparable knowledge and job skills
• Strong understanding of cybersecurity principles, security monitoring, incident response, and security operations processes
• Strong understanding of common cybersecurity threats, vulnerabilities, attack techniques, and adversary behaviour
• Ability to independently analyse alerts, correlate evidence, and determine appropriate response or escalation actions
• Strong written and verbal communication skills in English
• Preferred: experience with proactive threat hunting or advanced threat analysis; Incident Coordinator, Incident Commander, or security incident lead experience; scripting or automation for security analysis; post-incident reviews, root-cause analysis, or lessons-learned activities; phishing investigation and advanced threat intelligence analysis; security playbooks, procedures, or process-improvement initiatives

• Training and development programmes to enhance skills and knowledge
• Public holidays (mentioned in relation to shift work)