Security Operations Analyst

The Team

At Zopa, our Security Operations team plays an important role in protecting our banking services, systems and customers. We're a collaborative team with a mix of technical experience and professional backgrounds, working together to investigate security threats, respond to incidents and continuously improve how we operate.

Unlike traditional SOC teams focused solely on monitoring and incident response, our SecOps team also owns and manages a range of security tools and services. That means you'll have opportunities to develop experience beyond alert investigation, including vulnerability management, cloud security and other security technologies.

You'll work alongside experienced analysts who share their knowledge and support your development. You'll also collaborate with engineering, IT, fraud and customer-facing teams to understand and respond to security risks across the business.

A Day In The Life:

• Review, triage and investigate security alerts, events and incident tickets.
• Analyse security logs to identify suspicious activity, assess potential impact and determine appropriate next steps.
• Investigate common threats including phishing, malware and account compromise.
• Follow established incident response playbooks, escalating incidents and requesting support when needed.
• Maintain accurate investigation notes, ticket updates and incident documentation.
• Work within defined response and resolution expectations for security tickets.
• Collaborate with IT Services, Identity and Access Management, engineering, fraud and customer service teams.
• Develop practical experience with security technologies including Splunk, SentinelOne, Netskope and AWS security services.
• Participate in peer reviews and incident retrospectives, sharing lessons learned with colleagues.
• Support improvements to security processes and develop your understanding of vulnerability management, cloud security and security tooling.

About You:

You have practical experience in security operations or a relevant technical environment such as infrastructure, network, cloud operations or IT support, along with a blend of the following:

• Understanding of cyber security fundamentals, including phishing, malware, account compromise, vulnerabilities, threats and risks.
• Experience reviewing security alerts or analysing logs to investigate unusual activity.
• Knowledge of the incident response lifecycle and can follow documented procedures.
• Foundational knowledge of Windows, macOS, Linux and core networking concepts.
• Understand basic cloud concepts, particularly AWS services such as IAM, S3 and CloudTrail.
• You approach investigations analytically, gathering evidence and assessing potential impact before deciding what to do next.
• Communication is one of your strengths; you communicate clearly, document your findings accurately and know when to escalate.
• You can prioritise security tickets, manage your time and work within agreed service levels.
• You're curious, eager to learn, comfortable asking for support and committed to working collaboratively.

Added Bonus:

• Experience using SIEM, EDR or security tools such as Splunk, SentinelOne, Netskope, Mimecast, Tenable or AWS GuardDuty.
• Basic scripting experience using Python, Bash or PowerShell.
• Practical experience with phishing investigations or vulnerability management.
• Familiarity with the MITRE ATT&CK framework.
• Experience using Git or version control alongside engineering teams.
• Experience working in financial services, fintech or another regulated environment.
• Awareness of FCA requirements and UK GDPR.
• Security certifications such as CompTIA Security+, CySA+ or CEH, or a relevant degree.
• Experience safely using AI tools to support everyday work.