Cyber Defence Analyst

This is a hands-on role for someone looking to build their career in Cyber Defence, working with a global team to investigate security alerts, respond to cyber incidents and help protect an international organisation from evolving cyber threats. You’ll gain exposure across a broad range of Cyber Defence activities while continuing to develop your technical expertise in areas such as incident response, threat detection, security tooling, and process improvement.

Please note that weekend working is a requirement for this role, with exact shift patterns discussed at interview.

What you will do

Investigate escalations

• Investigate and prioritise escalated cyber security events and alerts, identifying potential incidents and escalating where appropriate.
• Investigate potential cyber security and data loss incidents raised by employees or third parties, following established Cyber Defence playbooks.
• Respond to information security queries, working with colleagues across the team to provide appropriate guidance.

• Support incident response activities, including the initial triage, investigation, containment, mitigation and remediation of confirmed incidents.
• Gather and document relevant forensic evidence to support investigations.
• Participate in security incident response exercises and contribute to post-incident and post-exercise reviews.
• Work with Cyber Defence teams across different time zones as part of our 24/7 follow-the-sun global model, ensuring effective handover of ongoing incidents.
• Maintain awareness of emerging cyber threats, techniques and procedures, applying threat intelligence insights to day-to-day investigations.
• Participate in the Cyber Defence on-call rota, including out-of-hours support where required.

• Support the implementation, enhancement and effective use of Cyber Defence tools and technologies.
• Help continuously improve Cyber Defence processes, playbooks and documentation.
• Identify opportunities to improve detection, investigation and response capabilities across the team.

• Work closely with Information Security, IT and other teams to strengthen the firm’s overall security posture.
• Provide practical Cyber Defence guidance to stakeholders, translating complex technical issues into clear, business-friendly language.

What you will have

• 1+ years’ experience in Security Operations, Cyber Defence, a SOC, or a similar technical security environment.
• Practical experience across at least two areas such as alert triage, incident response, security engineering, detection/rule writing, DFIR, threat intelligence, vulnerability management or security control testing.
• Working knowledge of key Cyber Defence technologies, including SIEM, IDS/IPS, endpoint protection/EDR, firewalls and threat or vulnerability management tooling.
• Strong networking fundamentals, particularly TCP/IP, DNS and SMTP.
• An analytical and investigative mindset, with the ability to assess alerts and data, identify potential security incidents and determine appropriate next steps.
• Strong communication skills and the ability to explain technical cyber security issues clearly to different audiences.

• Digital Forensics & Incident Response (DFIR), including relevant incident response or forensic training/certification.
• Penetration testing or web application security/testing.
• Scripting or automation using Python and/or PowerShell.
• Security experience across Azure, AWS or GCP.
• Relevant cyber security qualifications or certifications, such as CompTIA Security+, CEH, CISSP or CISM.

NO AGENCIES PLEASE - A&O Shearman does not accept unsolicited CVs. For further information, please see our UK Recruitment Agency Policy and our commitment to direct sourcing here.

#LI