Job Description:
Cyber Threat Analyst Roles and Responsibilities Tier 2 Analyst
* You must hold a UK passport only due to security clearance requirements. We can only accept candidates with single national status. (2nd passport holders, OCI & ILR candidates cannot be accepted). You must have been in the UK for the last 5 years. *
*This role is based onsite in DXC Erskine or Farnborough, covering a rotational 24x7 12-hour shift pattern*
** MUST have at least 6 months of experience working with SIEM technologies**
Job Description
The Tier 2 Cyber Security Analyst is a mid-tier position within the Cyber Threat Analysis Centre (CTAC), responsible for advancing initial work conducted by Tier 1 Analysts and providing in-depth analysis of potential threats. This role is crucial in escalated investigations, triage, and response to cyber incidents, while supporting the development and training of Tier 1 Analysts. The Tier 2 Analyst collaborates closely with senior and junior analysts to ensure seamless SOC operations and acts as a bridge between foundational and advanced threat detection and response functions.
Responsibilities:
1. Conduct escalated triage and analysis on security events identified by Tier 1 Analysts, assessing threat severity and advising on initial response actions.
2. Utilize expertise in SIEM solutions, specifically Kusto Query Language (KQL), to perform log analysis, event correlation, and thorough documentation of security incidents.
3. Identify and escalate critical threats to Tier 3 Analysts with detailed analyses for further action, ensuring rapid response and adherence to service level objectives (SLOs).
4. Investigate potential security incidents through deeper analysis of correlated events, identifying patterns or anomalies indicating suspicious or malicious activity.
5. Use OSINT (Open-Source Intelligence) techniques to enrich contextual data and improve detection capabilities, contributing to proactive threat management.
6. Monitor the threat landscape, document findings on evolving threat vectors, and share insights with CTAC teams to enhance situational awareness.
7. Follow established incident response playbooks, provide feedback for improvements, and suggest updates to streamline processes and improve threat response times.
8. Coordinate with Tier 3 Analysts and management to refine detection and response workflows, contributing to SOC maturity.
9. Collaborate with Tier 3 Analysts on tuning SIEM and detection tools to reduce false positives and improve alert accuracy, submitting tuning requests and testing configurations as needed.
10. Identify gaps in detection content and work with Senior Analysts to develop and validate new detection rules and use cases tailored to the organization’s threat profile.
11. Act as a mentor to Tier 1 Analysts, guiding on triage and analysis techniques, and facilitating on-the-job training to enhance their skills and operational efficiency.
12. Assist in training sessions and knowledge-sharing activities, providing feedback on areas for growth and fostering a supportive learning environment within the SOC.
Knowledge and Skills:
* Understanding of advanced networking concepts, including IP addressing, network protocols, and traffic flow within a network.
* Advanced knowledge of Windows and Linux operating environments, including commands, file systems, and user authentication mechanisms.
* Proficiency in using SIEM solutions (e.g., ArcSight, Azure Sentinel) for monitoring and log analysis; exposure to analysis tools such as XDR platforms.
* Ability to demonstrate proficient use of KQL for log searches and filtering.
* Familiarity with OSINT techniques for threat identification and information gathering.
* Effective communication skills to liaise with team members and stakeholders, both internally and externally, under senior guidance.
* Ability to explain technical issues clearly to non-technical audiences.
* Skill in creating concise, structured reports on investigations and daily monitoring activities.
* Effective workload management to ensure timely task completion within the SOC.
* Willingness to collaborate, accept guidance, and learn from experienced analysts.
* Initiative in learning new technologies and techniques, leveraging training resources for professional growth.
* Ability to operate efficiently under high-pressure situations, following procedures to ensure consistent incident management performance.
Education and Professional Experience:
o University Degree/Diploma in Cyber Security or equivalent experience.
o Additional IT certifications or experience such as CISSP, COMPTIA CySA+, GCIA, GCIH (Desirable).
o Certifications like CASP or ITIL are advantageous.
o Experience working in a SOC or equivalent environment.
o Security Clearance: SC / DV (or equivalent).
Other Requirements:
o Full Driving Licence.
o Fluent in written and spoken English.
At DXC Technology, we believe strong connections and community are key to our success. Our work model prioritizes in-person collaboration while offering flexibility to support wellbeing, productivity, individual work styles, and life circumstances. We’re committed to fostering an inclusive environment where everyone can thrive.
Recruitment fraud is a scheme in which fictitious job opportunities are offered to job seekers typically through online services, such as false websites, or through unsolicited emails claiming to be from the company. These emails may request recipients to provide personal information or to make payments as part of their illegitimate recruiting process. DXC does not make offers of employment via social media networks and DXC never asks for any money or payments from applicants at any point in the recruitment process, nor ask a job seeker to purchase IT or other equipment on our behalf. More information on employment scams is available here.
#J-18808-Ljbffr