{"id":82691,"url":"https://alion.io/job/beyondtrust-soc-analyst-2","title":"Cyber Defense Engineer","company":{"id":5291,"name":"BeyondTrust","domain":"beyondtrust.com","url":"https://alion.io/company/beyondtrust","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Greenhouse","truth_index":{"grade":"B","score":80,"open_postings":5,"ghost_share":0,"stale_share":0.8,"repost_share":0,"time_to_fill_p50_days":47,"computed_at":"2026-10-16T05:45:00Z"}},"role":"Security","role_family":"Security","seniority":"middle","employment_type":null,"work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"posting_text","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Manchester, United Kingdom"],"countries":["GB"],"hiring_countries":["GB"],"hiring_countries_total":1,"salary":null,"salary_estimate":{"min_usd":51000,"max_usd":122000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":714},"experience_years_min":4,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"BeyondTrust","optional":false},{"name":"LLM","optional":false},{"name":"SIEM","optional":false},{"name":"AI Agents","optional":true},{"name":"Claude Code","optional":true},{"name":"Copilot","optional":true},{"name":"PowerShell","optional":true},{"name":"Prompt Engineering","optional":true},{"name":"Python","optional":true}],"status":"live","first_seen_at":"2026-04-21T15:49:18Z","employer_posted_date":"2026-10-05","last_verified_at":"2026-10-16T19:31:45Z","board_verified":true,"closed_at":null,"days_open":178,"trust":{"level":"stale","repost_count":0,"flags":["stale"],"days_open":177},"description":"BeyondTrust is a place where you can bring your purpose to life through the work that you do, creating a safer world through our cybersecurity SaaS portfolio.\nOur culture of flexibility, trust, and continual learning means you will be recognized for your growth, and for the impact you make on our success. You will be surrounded by people who challenge, support, and inspire you to be the best version of yourself.\nThe Role\nBeyondTrust is a global leader in privileged access management. Our products provide remote access and privileged control capabilities that are deployed across thousands of enterprise environments worldwide. That makes us a high-value target. Nation-state actors, ransomware operators, and sophisticated threat groups actively target companies like ours-not just to compromise our corporate environment, but to reach the customers who trust our software to protect their most sensitive systems. A compromise of BeyondTrust is a compromise of the privileged access layer inside our customers’ networks. We take that responsibility seriously.\nAs a Cyber Defense Engineer on our Cyber Defense Operations team, you will serve as a front-line defender responsible for protecting both BeyondTrust’s enterprise infrastructure and the integrity of the products our customers depend on. You will monitor, investigate, and respond to security events in an environment where the stakes are real and the adversaries are capable. You will work alongside experienced threat hunters, incident responders, and detection engineers in a collaborative team that values sharp analytical thinking over checkbox compliance.\nThis team is building toward an AI-augmented operating model. You will be expected to use AI-driven tools in your daily work and to contribute to how we integrate these capabilities into our detection, triage, and response workflows. We are not looking for people who are waiting to be told what to do-we are looking for people who want to build something.\nWhat You’ll Do\nAlert Triage & Monitoring \nMonitor and triage security alerts across SIEM, EDR, and CSPM platforms covering both corporate and product environments.\nInvestigate alerts to determine scope, severity, and whether escalation is warranted.\nLeverage AI-assisted triage and enrichment tools to accelerate analysis and reduce mean time to detect.\nClassify, document, and track alerts through the full lifecycle using ticketing and case management systems.\nIncident Response & Investigation \nParticipate in or lead incident response engagements from detection through remediation, including evidence collection, forensic analysis, root cause determination, and stakeholder communication.\nConduct investigations across SIEM, EDR, CSPM, and cloud-native log sources including identity provider logs, cloud audit trails, and network flow data-spanning both corporate and product infrastructure.\nExecute established IR runbooks across identity, endpoint, cloud, and email investigation workflows.\nManage or assist with evidence handling, forensic artifact collection, and chain-of-custody procedures.\nProduce clear, decision-ready incident summaries and post-incident reports for both technical and leadership audiences.\nDetection Engineering & Threat Intelligence \nContribute to the design, implementation, and tuning of detection rules across SIEM and EDR platforms, with a focus on reducing false positives and closing coverage gaps.\nTranslate threat intelligence (CVE advisories, CISA alerts, vendor bulletins, open-source feeds) into actionable detection content, with particular attention to threats targeting privileged access tooling and supply chain attack vectors.\nHelp maintain and evolve detection coverage mapped to MITRE ATT&CK.\nPartner with threat hunting peers to validate detection logic through hypothesis-driven hunts.\nAI Integration & Automation \nUse AI-driven tools for alert triage, enrichment, and investigation as a standard part of daily operations.\nContribute to the evaluation, integration, and optimization of AI and automation capabilities across the team’s workflows.\nAssist in designing prompts, agent workflows, or LLM-based pipelines that augment analyst capabilities and reduce manual effort.\nPartner with engineering teams to improve log ingestion, data quality, and tool integrations.\nOperational Excellence \nMaintain daily operational notes and shift handoff documentation.\nContribute to and refine IR runbooks, playbooks, and standard operating procedures.\nParticipate in on-call rotation for after-hours incident escalation.\nTrack and report on operational metrics (MTTD, MTTR, MTTC, false positive rate) and identify improvement opportunities.\nParticipate in tabletop exercises, purple team activities, and post-incident reviews. \nWhat You’ll Bring\n4+ years of experience in a SOC, security operations, or incident response role.\nUnderstanding of common attack frameworks (MITRE ATT&CK), network protocols, and endpoint behavior.\nExperience with at least one SIEM platform and familiarity with writing search or detection queries.\nFamiliarity with EDR platforms and cloud environments (IaaS preferred).\nComfort using AI systems (e.g., LLM-based assistants, copilots, or AI-driven analysis tools) as part of security workflows.\nStrong written communication skills; able to document findings clearly and concisely for both technical and non-technical audiences.\nNice To Have\nExperience leading or co-leading complex incident response engagements from triage through remediation.\nExperience with identity and access management platforms and cloud security posture management tools.\nScripting and automation skills (Python, PowerShell, or equivalent) applied to security workflows.\nFamiliarity with SOAR platforms or orchestration tools for automated response and enrichment.\nExperience designing or implementing AI agent architectures, LLM-based automation pipelines, or prompt engineering for security use cases.\nExperience building or contributing to threat intelligence programs or detection-as-code pipelines.\nUnderstanding of the privileged access management landscape and the threat actors that target it.\nTrack record of evaluating and adopting emerging technologies in a production security environment.\nWhat We Offer\n\nCompetitive salary and pension with up to a 10% annual bonus\n25 days’ holiday which increases with length of service\nCompetitive pension scheme\nThree weeks' additional leave at seven years' service\nFully remote in the UK with up to 4 weeks per year under our Working Abroad policy (subject to approval)\nBupa Private Healthcare for you and family\nMedicash Benefit (including opticians and dental cover)\nLife insurance at 4x salary and income protection\nPaid parental leave and enhanced maternity leave\nEmployee Assistance Programme\nOpportunity to co-invest and become a BeyondTrust shareholder\nInvestment in AI skills, with Claude Code and Copilot centres of excellence\nPluralsight and LinkedIn Learning licenses\nBetter Together\n\nDiversity. Inclusion. They’re more than just words for us. They are the guiding values of how we build our teams, cultivate leaders, and create a culture where people feel connected.\nWe take care of our employees so they can take care of our customers. Customers who come from all walks of life just like us. We hire incredible people from diverse backgrounds because when we are different together, we are stronger together.\nAbout Us\nBeyondTrust is the global identity security leader protecting Paths to Privilege™. Our identity-centric approach goes beyond securing privileges and access, empowering organizations with the most effective solution to manage the entire identity attack surface and neutralize threats, whether from external attacks or insiders.\nBeyondTrust is leading the charge in transforming identity security to prevent breaches and limit the blast radius of attacks, while creating a superior customer experience and operational efficiencies. We are trusted by 20,000 customers, including 75 of the Fortune 100, and our global ecosystem of partners.\nLearn more at www.beyondtrust.com.","description_format":"text","description_chars":8085,"description_truncated":false,"requirements":{"experience_years_min":4,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Life insurance","Parental leave"],"hiring_locations":[{"name":"United Kingdom","iso":"GB","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","C4ISR","Identity Management","Incident Response"],"lifecycle":[{"event":"open","at":"2026-04-21T15:49:18Z"}],"visa":[],"liveness":{"score":9,"band":"cold","label":"Long shot","p_open":1,"p_active":0.336,"p_room":0.28,"age_days":177,"expected_fill_days":47,"reasons":["conf:3","velocity","win:tail","crowd:"],"computed_at":"2026-10-16T05:45:00Z"},"pay":null,"html_url":"https://alion.io/job/beyondtrust-soc-analyst-2","json_url":"https://alion.io/job/beyondtrust-soc-analyst-2.json","meta":{"generated_at":"2026-10-16T22:23:56Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":3980,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-17T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":5291},"rest":"https://alion.io/mcp/rest/get_company?id=5291"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fbeyondtrust-soc-analyst-2"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fbeyondtrust-soc-analyst-2"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fbeyondtrust-soc-analyst-2"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/beyondtrust-soc-analyst-2\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fbeyondtrust-soc-analyst-2"}]}