Senior Threat Detection Analyst

KPMG
London
4 months ago
Applications closed

Related Jobs

View all jobs

Senior SOC Analyst

Senior SOC Analyst

OSB Senior Security Analyst

Security Analyst

Sr Digital Forensics Incident Response Analyst

Cyber Security Analyst R2

Job description

Senior Threat Detection Analyst

Base Location:Hybrid/UK based (core office in London) plus network of 20 offices nationally:

 

The KPMG EWT function is a cornerstone of our business. We do work that matters to our local business and communities – supporting technical innovation and adoption of cutting-edge solutions across the UK. Working on complex engagements in enterprise technology this team is responsible for the delivery of cutting-edge technical solutions and trusted to get it right first time.

 

KPMG is one of the world's largest and most respected consultancy businesses, we've supported the UK through times of war and peace, prosperity and recession, political and regulatory upheaval. We've proudly stood beside the institutions and businesses which make the UK what it is.

 

Why join KPMG EWT as a Senior Threat Detection Analyst?

The Team is an important function within Security Operations in KPMG. The team play a key role in ensuring that the business IT systems are protected and monitored from cyber threats. The team works with external MSSPs to monitor, analyse, report cyber security threats and respond accordingly. The team works with the different internal business capabilities to ensure that security monitoring service is embedded into their solutions. The team is also responsible for making sure that security monitoring is aligned with cyber threat landscape and business risks on an ongoing basis.

 

The person will be playing a key role in ensuring that the business IT systems are protected and monitored from threats, participate in the active monitoring of the security sensors and ensure that appropriate actions are taken as part of the Incident Response process, work with the different KPMG business capabilities to ensure that security monitoring service is embedded into their solutions.

 

You will be part of on-call rota for SOC and required to be on-call for one week at a time typically, during a month.

 

What will you be doing?

Act as an escalation point for other security analysts in the SOC, including 3rd party MSSP Co-ordinate SOC team response and work with Threat Detection manager to improve triage processes Deputise Threat Detection Manager with full delegated responsibilities, when required Proactively monitor the network security sensors ensuring timely detection, investigation and remediation of potential threats in line with the incident management lifecycle Use the advanced security analytics toolsets to monitor for emerging threat patterns and vulnerabilities, attempted or successful breaches Work closely with other KPMG teams to ensure that all technologies are activity monitored including troubleshooting where necessary Interact with the Global Security Operations Centre (GSOC) & MSSP, including Incident response and intelligence sharing, escalating to management where required Triage and manage incidents, events and queries from the business to the relevant resolver group Contribute to the Continual Service Improvement of the teams' operations through proactive analysis, engagement and collaboration Detect, respond and coordinate response for security events while capturing essential details and artefacts Operationalise actionable intelligence reports from Threat Intelligence team and external sources Maintain event response documentation, participate in post-mortems, and write event reports Contribute to projects that enhance the security posture of KPMG Identify trends, potential new technologies, and emerging threats, which may impact KPMG Review and prioritise alerts based on Standard Operating Procedures Review and triage suspected security events reported by staff members or Security Monitoring platforms Accurately document work in Incident case management system as per defined standards Leverage multiple data sources to analyse detection alerts and staff reported cyber-attacks to identify which events require response activities based on Standard Operating Procedures Declare an incident and escalate it to Incident Response team, ensuring findings have been accurately captured in the Incident case management system as per defined standards Ensure that cases are accurately categorised to ensure the appropriate feedback is provided to the Detection and Response Engineering team and to facilitate reporting Identify and record gaps in visibility and security posture through the course of investigations as per defined Standard Operating Procedures Identify potential new detection logic and escalate to the Detection and Response Engineering team Hunt for threat indicators from log data and other available endpoint/network artefacts

 

What will you need to do it?

Prior experience in Cyber Security Experience of working in a Security Operations Centre or Security Monitoring Team. Experience with managed security services and security consulting would be a plus Hands on SIEM and EDR tooling knowledge and experience including technologies such as Microsoft Sentinel, Microsoft Defender Suite etc. Experience in end-to-end information security incident management and mitigating and addressing threat vectors including Advanced Persistent Threat (APTs), Distributed Denial of Service (DDoS), Phishing, Malicious Payloads, Malware, etc Experience with Intrusion Detection Systems (IDS), Intrusion Prevention Systems (IPS), Web Application, Firewalls, Firewall logs, systems logs, web logs, application logs and Security Information and Event Management (SIEM) systems Experience with technologies, tools, and process controls to minimise risk and data exposure. Experience in search query languages such as KQL, OSquery or SPL Solid experience of working in Cloud environments such as AWS, Azure, & GCP Experience with building threat-based Use Cases using frameworks such as MITRE ATT&CK Solid understanding of ISO 27001, Cyber Essentials/Essentials Plus, GDPR and other information security-related regulatory and compliance standards Understanding of security threats, attack scenarios, intrusion detection and incident management Ability to function effectively in a matrix structure Ability to deal with ambiguity and to keep a cool head when dealing with crisis or stressful situations Strong analytical skills Apply analytical rigor and demonstrate business acumen to understand complex business scenarios Fluent in English

 

Skills we’d love to see/Amazing Extras:

Already holds, or can be SC cleared Bachelor’s degree in Computer Science or related field Information Security and/or Information Technology industry certification (CISSP, SANS GIAC, SC-200, AZ-500 or equivalent)  

Our Locations:

With 20 sites across the UK, we can potentially facilitate office work, working from home, flexible hours, and part-time options. If you have a need for flexibility, please register and discuss this with our team.

 

Find out more:

Within Consulting we have a range of divisions and specialisms. Click the links to find out more below:

Consulting at KPMG:ITs Her Future Women in Tech programme:KPMG Workability and Disability confidence:

 

For any additional support in applying, please click the links to find out more:

Applying to KPMG:Tips for interview:KPMG values:KPMG Competencies:

KPMG Locations and FAQ:

Get the latest insights and jobs direct. Sign up for our newsletter.

By subscribing you agree to our privacy policy and terms of service.

Industry Insights

Discover insightful articles, industry insights, expert tips, and curated resources.

Contract vs Permanent Cybersecurity Jobs: Which Pays Better in 2025?

Cybersecurity has become one of the fastest-growing and most crucial fields in modern business. With high-profile breaches dominating headlines and the ongoing digital transformation exposing organisations to new threats, companies across the UK are competing to attract skilled cybersecurity professionals. Roles range from penetration testers (pen testers) and SOC (Security Operations Centre) analysts to compliance officers, cloud security architects, threat intelligence analysts, and CISOs (Chief Information Security Officers). As demand continues to surge, cybersecurity salaries have climbed accordingly, and businesses have turned to more flexible hiring practices. Alongside permanent employment, many professionals explore short-term day‑rate contracting or fixed-term contracts (FTCs), searching for the ideal balance of pay, job security, and growth opportunities. Which arrangement truly pays better in 2025—and which best aligns with your ambitions? In this article, we dive into the contract vs. permanent debate with a focus on cybersecurity roles. We will examine the current market, the structure of day‑rate vs. FTC vs. permanent positions, the pros and cons of each, and some hypothetical pay comparisons. By the end, you should have a clearer sense of which career path might suit your situation and goals—whether you are a seasoned specialist aiming for top rates, or an up-and-coming analyst seeking a stable environment to develop in.

Cyber Security Jobs for Non‑Technical Professionals: Where Do You Fit In?

Defence Needs More Than Hackers in Hoodies When headlines warn of ransomware crippling hospitals or deepfakes swaying elections, we picture hoodie‑clad hackers and elite penetration testers. Yet the reality of the UK’s cyber security sector is broader—and desperately short of talent. The Department for Science, Innovation & Technology (DSIT) estimates a shortfall of 11,200 cyber security professionals in 2024, while 43 % of advertised roles require governance, risk or communication skills rather than hands‑on technical exploits. Put plainly: if you can guide policy, manage projects, interpret regulations or inspire behaviour change, cyber security wants you. This guide highlights the fastest‑growing non‑technical roles, the transferable skills you already possess, and a concrete 90‑day plan to land a cyber security job—no packet sniffers required.

BAE Systems Cybersecurity Jobs in 2025: Your Complete UK Guide to Protecting Governments, Businesses and Critical Infrastructure

From securing the Royal Navy’s new Dreadnought submarines to foiling multimillion‑pound fraud rings, BAE Systems Digital Intelligence (DI)—formerly Detica—sits at the sharp end of global cyber defence. Head‑quartered in Guildford with hubs in Gloucester, Leeds and London, the 5,500‑strong DI business delivers threat‑intelligence platforms, secure‑by‑design software and 24/7 SOC services to government and commercial clients worldwide. With escalating ransomware, AI‑driven disinformation and complex supply‑chain threats, BAE plans to expand its UK cyber workforce by 20 % in 2025. Whether you’re a graduate passionate about reverse engineering, a DevSecOps engineer who loves IaC, or an incident‑response pro comfortable in high‑side environments, this guide explains how to land a BAE Systems cybersecurity job in 2025.