Attack Monitoring Shift Lead (GSOC)

About the role

LSEG Security Operations monitors and responds to cyber security incidents across cyber threat intelligence, detection, data loss prevention and incident response. This Attack Monitoring Shift Lead role leads and manages the team in the Global Security Operations Centre (GSOC) that identifies and responds to cyber security incidents and improves the centre's defensive capabilities. The role suits someone with a solid technical background, strong leadership qualities and excellent people skills.

The role operates on a shift rotation of 07:00 - 19:00 SGT or 08:00 - 20:00 SGT (subject to UK BST) on a 4 days on, 4 days off cycle.

Key responsibilities

• Lead and manage a team to identify and respond to cyber security events and incidents.
• Triage security events and apply a methodical, coherent response to incidents.
• Operate a chosen SIEM (e.g. Splunk, QRadar, LogRhythm) for incident investigations or for building monitoring dashboards.
• Use playbooks, existing knowledge and online resources when responding to incidents.
• Research and collect threat intelligence to strengthen the SOC's ability to detect cyber attacks.
• Develop or improve run books and use cases based on investigations and knowledge of modern attacks.
• Stay up to date with vulnerabilities, attacks and countermeasures.
• Identify, respond to and remediate cyber events detected by monitoring tools.
• Serve as a point of escalation for incident triage and investigation.

Required profile

• Experience with operating or administering a SIEM (Splunk, QRadar, LogRhythm).
• Strong knowledge of networks, including the TCP/IP stack, organisational architectures and protocols abused by malware.
• Experience in security event analysis and triage, incident handling and root cause identification.
• Understanding of attacker tools, techniques and procedures, ideally from direct experience.
• Knowledge of cyber security in corporate environments; likely full-time incident response or offensive security experience.
• Ability to stay calm under pressure and strong verbal and written communication skills.
• Core security accreditations such as OSCP, GIAC or CCNA, and a SIEM certification.
• Competence in one or more programming languages (e.g. Python, PowerShell, Java, C#).