{"id":3282817,"url":"https://alion.io/job/hayfin-cybersecurity-analyst","title":"Cybersecurity Analyst","company":{"id":682533,"name":"Hayfin","domain":"hayfin.com","url":"https://alion.io/company/hayfin","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workable","truth_index":null},"role":"Security","role_family":"Security","seniority":null,"employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["London, United Kingdom"],"countries":["GB"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":63000,"max_usd":143000,"period":"year","method":"role_country_seniority_unknown","sample_n":159},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Azure","optional":false},{"name":"ISO 27001","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"PowerShell","optional":true},{"name":"Python","optional":true},{"name":"Zscaler","optional":true}],"status":"live","first_seen_at":"2026-10-26T17:19:16Z","employer_posted_date":"2026-10-26","last_verified_at":"2026-10-29T21:15:38Z","board_verified":true,"closed_at":null,"days_open":3,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":3},"description":"We are growing our Cloud Infrastructure & Information Security team, and we are looking for a hands-on Cybersecurity Analyst to help us raise the bar. Security sits at the heart of how Hayfin protects its investors, its partners and its reputation.\nThe Role\nYou will own the day-to-day security operations of our Microsoft-native estate and act as the technical bridge between our in-house team and our managed Security Operations Centre (SOC). It is a role with real independence: you might lead an incident from first escalation to root-cause review, tune a Defender XDR detection after a threat hunt, or pull together the evidence that satisfies our ISO 27001 auditors and regulators.\nYou will work closely with the Director of Cloud Infrastructure & Information Security, our engineers, Compliance and Risk, and our external partners. Hayfin is a place where good ideas get heard, and you will have the room to shape the security roadmap and automate the routine so the team can focus on what matters.\nResponsibilities\nActing as first point of escalation from the managed SOC, leading investigation, containment and root-cause analysis for Defender XDR and Sentinel incidents\nDeveloping and tuning detections and KQL queries, and running threat hunts mapped to MITRE ATT&CK\nHardening our Microsoft environment across Entra ID, Intune, Defender for Endpoint and Azure, and owning the vulnerability management lifecycle\nAdministering our email, web and data security controls, and running the phishing simulation and awareness programme\nProducing audit evidence and monthly security metrics for ISO 27001, FCA and DORA obligations, and supporting due diligence on vendors and portfolio companies\nHolding the managed SOC to account and contributing to the security roadmap\nRequirements\nYou have built your career in security operations or security engineering, and you are ready to take on more ownership. You are calm under pressure, and you write as clearly as you investigate.\nYou're likely to have:\nAround 3 years' hands-on experience in a SOC, security operations or security engineering role\nStrong practical experience with Defender XDR, Sentinel, Entra ID and Intune\nDemonstrable incident response experience\nExperience working with or alongside a managed SOC or MSSP\nClear, concise written communication, from incident reports to management-ready metrics\nIt would be a bonus if you also have:\nKQL and MITRE ATT&CK knowledge\nMicrosoft SC-200, SC-100 or AZ-500 certification\nExperience in financial services or another regulated environment, and familiarity with ISO 27001, FCA or DORA\nExposure to email and web security platforms such as Mimecast, Egress or Zscaler\nScripting or automation experience (PowerShell, Python, Logic Apps)\nExperience supporting penetration test remediation or purple-team exercises","description_format":"text","description_chars":2818,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Information Security","Business & SME Lending","Hedge Funds & Alternative Investments"],"lifecycle":[{"event":"open","at":"2026-10-26T17:19:16Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":2,"expected_fill_days":22,"reasons":["conf:2","win:early"],"computed_at":"2026-10-29T05:49:05Z"},"pay":null,"html_url":"https://alion.io/job/hayfin-cybersecurity-analyst","json_url":"https://alion.io/job/hayfin-cybersecurity-analyst.json","meta":{"generated_at":"2026-10-29T22:43:23Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":33592,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-30T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":682533},"rest":"https://alion.io/mcp/rest/get_company?id=682533"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fhayfin-cybersecurity-analyst"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fhayfin-cybersecurity-analyst"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fhayfin-cybersecurity-analyst"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/hayfin-cybersecurity-analyst\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fhayfin-cybersecurity-analyst"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3282817}},{"tool":"search_jobs","arguments":{"company":"hayfin.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3282817},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}