{"id":185843,"url":"https://alion.io/job/jpmorganchase-security-operations-analyst-soc-analyst","title":"Security Operations Analyst (SOC analyst)","company":{"id":257,"name":"JPMorganChase","domain":"jpmorganchase.com","url":"https://alion.io/company/jpmorganchase","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Oracle","truth_index":{"grade":"A","score":90,"open_postings":1129,"ghost_share":0.01,"stale_share":0.543,"repost_share":0.058,"time_to_fill_p50_days":12,"computed_at":"2026-10-29T05:49:05Z"}},"role":"Security","role_family":"Security","seniority":"junior","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["London, United Kingdom"],"countries":["GB"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":71000,"max_usd":136000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":10},"experience_years_min":2,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Cyber Kill Chain","optional":false},{"name":"DNS","optional":false},{"name":"Linux","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"SIEM","optional":false},{"name":"TCP/IP","optional":false},{"name":"Windows","optional":false},{"name":"AWS","optional":true},{"name":"Azure","optional":true},{"name":"GCP","optional":true},{"name":"YARA","optional":true},{"name":"YARA","optional":true}],"status":"live","first_seen_at":"2026-09-01T00:00:00Z","employer_posted_date":"2026-09-01","last_verified_at":"2026-10-29T06:23:39Z","board_verified":true,"closed_at":null,"days_open":58,"trust":{"level":"ok","repost_count":1,"flags":[],"days_open":58},"description":"About JPMorganChase and the Team\nJPMorganChase is a global leader in financial services, serving millions of clients and many of the world's most prominent corporate, institutional, and government clients. Protecting the firm, its customers, and the integrity of the global financial system is a foundational priority, and the Cybersecurity Operations organization is central to that mission. Within it, the Detection and Response team serves as the front line of the firm's cyber defense, operating a global \"follow-the-sun\" model that delivers 24/7 monitoring, detection, and response across regions. The London SOC is a critical hub anchoring coverage across EMEA, working seamlessly with partner centers worldwide to ensure continuous, uninterrupted protection.\nRole Overview\nThis is a hands-on detection and response role at the core of the firm's cyber defense operations. The analyst will primarily triage security alerts and investigate cases end-to-end, while contributing to threat hunting, detection engineering, and the adoption of AI-assisted tooling to improve investigative efficiency and accuracy. The position suits a technically strong practitioner who thrives in a fast-paced, high-stakes environment and is motivated by continuous improvement.\nWorking Model and Schedule\nThe team operates a follow-the-sun model to guarantee continuous global coverage. Analysts work standard weekday business hours, for the most part, with weekend shift coverage required on a rotational basis approximately once every five (5) weeks. This rotation ensures uninterrupted monitoring and response capability across all time zones and handoff points.\nKey Responsibilities\nTriage and analyze security alerts from SIEM, EDR, and other detection tooling, prioritizing based on severity, risk, and business impact.\nInvestigate security incidents and cases end-to-end, from initial detection through containment, eradication, and documented resolution.\nConduct proactive threat hunting across endpoints, networks, cloud, and identity telemetry to identify undetected threats and emerging adversary behavior.\nContribute to detection engineering: develop, tune, and refine detection rules, use cases, and correlation logic to reduce false positives and improve coverage.\nLeverage AI and automation tooling (e.g., AI-assisted triage, enrichment, and summarization) to accelerate investigations and improve analyst efficiency.\nDocument findings, maintain accurate case records, and produce clear incident reports and post-incident reviews.\nCollaborate with global SOC teams, threat intelligence, incident response, and engineering functions to ensure seamless handoffs under the follow-the-sun model.\nContribute to continuous improvement of SOC playbooks, runbooks, and standard operating procedures.\nStay current with the evolving threat landscape, attacker TTPs (mapped to frameworks such as MITRE ATT&CK), and industry best practices.\nRequired Qualifications, Capabilities, and Skills\nDemonstrable experience in a SOC, incident response, or security analyst role (typically 2+ years).\nSolid understanding of security monitoring and investigation across SIEM, EDR/XDR, and network security tooling.\nWorking knowledge of common attack techniques, the cyber kill chain, and the MITRE ATT&CK framework.\nStrong understanding of core networking concepts (TCP/IP, DNS, HTTP/S, proxies, firewalls) and operating system internals (Windows, Linux).\nExperience investigating alerts across endpoint, network, cloud, and identity/authentication logs.\nAbility to analyze logs, correlate events across multiple data sources, and reconstruct incident timelines.\nStrong written and verbal communication skills for clear documentation and stakeholder updates.\nAbility to work under pressure, prioritize effectively, and participate in weekend shift rotation (approximately once every five weeks).\nPreferred Qualifications, Capabilities, and Skills\nExperience with detection engineering and writing/tuning detection content (e.g., Sigma, YARA, KQL, SPL, or equivalent).\nHands-on threat hunting experience using hypothesis-driven methodologies.\nFamiliarity with SOAR platforms, scripting/automation, and AI-assisted security tooling.\nExperience defending large, complex enterprise or financial-services environments.\nExposure to cloud security monitoring (AWS, Azure, or GCP).\nKnowledge of threat intelligence concepts and integration into detection and response workflows.\nEducation and Certifications\nBachelor's degree in Computer Science, Information Security, or a related field, or equivalent practical experience.\nIndustry certifications are advantageous, such as: CompTIA Security+, CompTIA CySA+, GIAC (GCIH, GCIA, GCFA, GDAT), Blue Team Level 1/2 (BTL1/BTL2), CEH, or cloud security certifications (AWS/Azure/GCP security).","description_format":"text","description_chars":4807,"description_truncated":false,"requirements":{"experience_years_min":2,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":true},"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","Wealth Management & Financial Advisors","Asset Management & Funds","Investment Banking & M&A Advisory"],"lifecycle":[{"event":"open","at":"2026-09-01T15:49:08Z"},{"event":"reopen","at":"2026-10-22T09:52:14Z"}],"visa":[],"liveness":{"score":3,"band":"cold","label":"Long shot","p_open":1,"p_active":0.117,"p_room":0.28,"age_days":58,"expected_fill_days":12,"reasons":["conf:1","stale_co","velocity","win:tail","crowd:junior,brand"],"computed_at":"2026-10-29T05:49:05Z"},"pay":null,"html_url":"https://alion.io/job/jpmorganchase-security-operations-analyst-soc-analyst","json_url":"https://alion.io/job/jpmorganchase-security-operations-analyst-soc-analyst.json","meta":{"generated_at":"2026-10-29T06:32:10Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":9880,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-30T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":257},"rest":"https://alion.io/mcp/rest/get_company?id=257"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fjpmorganchase-security-operations-analyst-soc-analyst"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fjpmorganchase-security-operations-analyst-soc-analyst"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fjpmorganchase-security-operations-analyst-soc-analyst"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/jpmorganchase-security-operations-analyst-soc-analyst\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fjpmorganchase-security-operations-analyst-soc-analyst"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":185843}},{"tool":"search_jobs","arguments":{"company":"jpmorganchase.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":185843},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}