Security Operations Center Analyst

Please note – this role is based in the UK and we, unfortunately, are not able to provide visa sponsorship. What we’re offering (saves you scrolling straight to the bottom ): Salary: £45,000-60,000 depending on experience. Holiday: 21 days paid holiday plus bank holidays (increasing by 1 day for each year worked) Flexible Working: We love getting the team together in the office, so we typically spend two days per week together in our lovely London office (39 floors up in Canary Wharf ). For the rest of your time, you can choose to work from wherever you are most productive and happy. Working Hours: 4 days on 4 days off; 12 hours per day. Training: Budget for one certification/course per year. Socials: We meet regularly to have a drink, throw some axes, play some crazy golf, etc. Start Date: ASAP About CyPro We are an innovative cyber security start-up united in a shared mission: to redefine cyber security for small and medium-sized businesses (SMBs). Our Founders – Jonny & Rob - spent most of their early careers delivering cyber security for large enterprises and central government, and they saw a clear need for a new approach to cybersecurity, especially as small to medium-sized businesses became increasingly targeted by cyber criminals. Indeed, by 2022, SMBs were the focus of 75% of cyber attacks, largely due to them being easy targets. Together, CyPro is already setting new standards, defining innovative solutions and equipping its clients with the cyber security they need to prevent attacks, secure bigger clients, and scale to new heights of success. We are growing quickly as a business and the next few years promise more of the same. Joining CyPro will allow you to become an integral part of our mission and join a team industry experts embarking on this exciting journey. The Role You will be a lead within in our Security Operations Centre team, which provides 365-day monitoring and response capabilities to our growing customer base. Day-to-day you will be responsible for: Monitoring: Monitor security alerts generated by Microsoft Sentinel and Microsoft Defender and assess their severity and impact. Intelligence Feeds: Analyse threat intelligence feeds to identify potential threats and vulnerabilities relevant to our clients’ environments. Development: Develop and implement new detection rules within Microsoft Sentinel to maintain and expand coverage of the MITRE ATT&CK framework, ensuring comprehensive threat detection. Response: Respond to security incidents by following the established incident response runbooks and procedures. Automation: Design and develop Logic Apps to provide automated responses to incidents, where applicable, to enhance efficiency and reduce response times. Recording: Document all security incidents, actions taken, and outcomes within CyPro’s integrated JIRA Service Management platform. Updating: Regularly review and update incident response runbooks to ensure they reflect the latest threat landscape and best practices. Recommending: Provide recommendations for enhancing the security posture of clients based on incident findings, root cause analysis and threat intelligence. Training: Participate in and contribute to ongoing security training and awareness programs for the SOC team and clients. Who are we looking for: Self-Starters – We are not (yet) a large FTSE organisation with well-documented procedures in place for everything. You will need to operate in an environment often with little guardrails – we are looking for people who are excited by this ‘green field’ mentality. Ambitious & Driven – do you aspire to grow beyond this role? Lead a team? Become part of the leadership team in years to come? If so, let’s chat. Always Improving - we are a growing business and want our people to learn and grow with us. What we think you need to be successful: A technical academic background in computer science, software engineering, information security, or a related field. At least two years industry experience working within a Security Operations team monitoring and responding to incidents. Hands on expertise within Microsoft Sentinel and Microsoft Defender. To be a Microsoft certified Security Operations Analyst Associate (SC-200). To possess the following skills: Problem-Solving: Ability to quickly and effectively identify, troubleshoot, and resolve security incidents and issues. Attentiveness: Attention to detail to ensure accurate detection, analysis, and documentation of security incidents. Continuous Improvement Mindset: A strong desire and commitment to continuously improve security processes, procedures, and technologies. Strong Communications: Confident and clear in communicating with clients, explaining security incidents, and providing actionable recommendations in an easy-to-understand manner. Flexible working: Ability to work effectively both independently and collaboratively within a team environment. Analytical Thinking: Strong analytical skills to interpret complex security data and identify potential threats and vulnerabilities. Technical Expertise: In-depth knowledge of security principles, standards, and best practices. Incident Response Knowledge: Familiarity with incident response frameworks and experience in managing security incidents. Understanding of Security Tools: Proficiency in using various security tools and platforms, such as SIEMs, IDS/IPS, and threat intelligence platforms. Proficiency in Writing KQL Queries for Forensics: Strong ability to write and optimize Kusto Query Language (KQL) queries for conducting forensic investigations and analysing security events. Scripting and Automation: Skills in using Azure Logic Apps for building automated response workfows. Continuous Learning: A proactive approach to staying updated with the latest security trends, threats, and technologies. Two Stage Hiring Process Intro Discussion (30 minutes, Remote): Initial chat for you to learn more about the role and for us to discover a bit about you and what you are looking for. Technical Evaluation & Final Interview (2 hours, our London office): A mini project for you to complete on-site – no prep required. A final interview with both founding partners.