Senior Attack Monitoring Analyst, GSOC

About the role

The London Stock Exchange Group (LSEG) is looking for an experienced Senior Attack Monitoring Analyst to join its Global Security Operations Centre (GSOC). LSEG Security Operations monitors and responds to cybersecurity incidents using people, process and technology, and this role identifies and responds to incidents while improving the GSOC's defensive capabilities. The role is open to London and Singapore, with working hours following UK business hours (9:00 AM - 6:00 PM GMT) or Singapore hours (preferably 2:00 PM - 10:00 PM SGT); Singapore hours are flexible.

Key responsibilities

• Triage security events and respond to incidents methodically, using playbooks where needed
• Operate a chosen SIEM (e.g. Splunk, QRadar, LogRhythm) for incident investigation or monitoring dashboard development
• Use playbooks, knowledge and online resources to respond to incidents
• Research and collect threat intelligence to improve detection of cyber-attacks
• Develop or improve run books and use cases based on investigations and knowledge of modern attacks
• Stay up to date with vulnerabilities, attacks and countermeasures
• Identify, respond to and remediate cyber events detected by monitoring technologies

Required profile

• Preferred experience operating or administering a SIEM (Splunk, QRadar, LogRhythm)
• Solid understanding of networks, including the TCP/IP stack, organisation architectures and protocols abused by malware
• Experience in security event analysis and triage, incident handling and root-cause identification
• Knowledge of attacker tools, techniques and procedures, ideally from direct experience
• Cybersecurity knowledge, academic or corporate
• Ability to stay calm in a fast-paced, demanding environment
• Strong verbal and written communication and collaboration skills
• Security accreditations such as OSCP, GIAC, CCNA; certification showing SIEM competence

Required skills

• Proficiency in one or more programming languages (e.g. Python, PowerShell, Java, C#)
• SIEM operation (Splunk, QRadar, LogRhythm)