Cyber Defence Analyst

Description

Cyber Defence Analyst

Location: Farnborough

Clearance - SC to start, DV for role

UNLEASH YOUR POTENTIAL

Everything we do is built on a commitment to do the right thing for our customers, our people and our community. Our mission and our values guide the way we do business. The foundations of our Leidos culture are our Values, Beliefs and Expectations by which we select, recognise and reward employees. They create the environment that drives us toward our mission.

The Cyber Defence Analyst protects customer services by identifying, investigating and helping to contain cyber threats across a 24x7x365 multi-customer CSOC.

The role converts security telemetry, threat intelligence and vulnerability information into timely, evidence-led decisions. Success is demonstrated through accurate alert disposition, complete incident records, decisive escalation, effective handovers and practical improvements to detection and response.

Typically knowledge of CSOC or security operations experience, or credible transferable cyber security knowledge, qualifications and practical aptitude, supported by the motivation to develop quickly in the role.

Your Key Outcomes and Responsibilities

• Monitor security alerts continuously and take timely, consistent action in line with agreed service priorities, protecting customer services and reducing the time threats remain undetected or uncontained.

• Analyse alerts and supporting telemetry from SIEM, EDR and XDR platforms to establish the context, scope, severity and potential business impact of suspicious activity.

• Distinguish true positives from benign or false-positive activity, document an evidence-based rationale and escalate material risk without delay.

• Create and maintain complete, accurate cyber security incident records in the relevant IT service management (ITSM) tool, ensuring that evidence, timestamps, affected assets, indicators, actions, ownership and escalation decisions support effective response, handover and audit.

• Correlate logs and events across multiple sources to identify suspicious patterns, likely attack paths and Indicators of Compromise (IOCs), improving investigative confidence and speed.

• Map observed adversary behaviour to relevant MITRE ATT&CK tactics, techniques and sub-techniques, supporting consistent analysis, clearer communication and visibility of detection coverage.

• Create, test and tune threat-hunting queries and, where appropriate, convert validated findings into detection rules that improve coverage, signal quality and analyst efficiency.

• Apply Cyber Threat Intelligence (CTI) to investigations and hunting, translating relevant indicators, adversary behaviours and affected technologies into practical detection, prioritisation and response actions.

• Assess vulnerabilities in context, explaining likely impact, exposure, exploitability and available evidence of exploitation so that stakeholders can prioritise proportionate remediation.

• Recommend proportionate countermeasures and coordinate agreed containment, eradication and recovery actions to reduce risk and restore secure operations.

• Proactively identify suspicious activity, exploitable vulnerabilities and security misconfigurations, enabling action before they result in material customer impact.

• Apply incident response processes, playbooks and prioritisation criteria consistently; contribute evidence to root-cause analysis and lessons learned so that repeat risk is reduced.

• Produce concise, accurate incident records, reports and shift handovers that make decisions, actions, residual risks, ownership and next steps unambiguous.

• Safeguard customer information and maintain strict separation, confidentiality and professional discretion when working across multiple accounts.

• Collaborate with technical teams, customers and other stakeholders to drive investigations and agreed response actions to a controlled, documented conclusion.

• Contribute to tabletop exercises, post-incident reviews and measurable service improvements that strengthen detection, response and operational resilience.

Technology and Process Experience

• Experience investigating security events and incidents in a CSOC or comparable environment, or demonstrable transferable skills and the ability to develop rapidly.

• Working knowledge of Microsoft Sentinel, Microsoft Defender XDR, Microsoft Defender Vulnerability Management, Microsoft Azure and Amazon Web Services (AWS).

• Experience of proactive threat hunting and of using validated investigation outcomes to improve detection and response.

• Understanding of the Confidentiality, Integrity and Availability (CIA) triad and its practical application when assessing technical and business impact.

• Current awareness of malware, ransomware and advanced persistent threat activity affecting cloud and on-premises environments.

• Practical knowledge of MITRE ATT&CK and its use in describing tactics, techniques, sub-techniques and observed adversary behaviour.

• Experience working within change-controlled environments and following authorised operational procedures.

• Exposure to HMG-classified systems or programmes is advantageous but not essential.

• Understanding of core networking concepts, including TCP/IP, DNS, HTTP/S, common ports and protocols, and how network and cloud security controls generate investigative evidence.

• Ability to interpret common endpoint, identity, cloud, network and application log sources and recognise where evidence gaps may limit investigative confidence.

Communication and Professional Skills

• Communicates technical findings, risk and recommended actions clearly to technical and non-technical audiences through handovers, incident records, reports and stakeholder briefings.

• Demonstrates calm judgement and professional credibility when presenting evidence, challenging assumptions and making proportionate recommendations under pressure.

• Builds trusted relationships with customers and internal stakeholders while maintaining appropriate confidentiality, account separation and professional boundaries.

• Approaches problems logically, tests assumptions and develops practical, prioritised remediation plans.

• Manages competing priorities, recognises material risk and escalates decisively through the appropriate route when required.