Threat Analyst

What you will do

• Investigate escalated security alerts and incidents across endpoint, network, cloud, and identity environments.
• Perform structured analysis to determine root cause, attack scope, lateral movement, and potential impact.
• Support ransomware investigations by analysing attacker activity, credential abuse, persistence mechanisms, and malware behaviour.
• Deobfuscate suspicious scripts, malware samples, and other indicators to identify malicious activity.
• Conduct proactive threat hunts based on defined hypotheses and emerging threat intelligence.
• Investigate suspicious authentication activity, privilege escalation, and identity misuse.
• Perform investigations on both Windows and Linux systems, including log and process analysis.  
• Correlate data across multiple sources, including EDR, SIEM, cloud logs, and identity platforms.
• Document investigative findings clearly and provide actionable remediation guidance to clients. 
• Collaborate with senior analysts during high-severity or complex incidents. 
• Contribute to detection tuning and improvement of response playbooks based on investigation outcomes. 
• Participate in a rotational schedule supporting a 24x7x365 MDR environment. 

What you will bring

• 4–6 years of experience in a SOC, MDR, Incident Response, or related cybersecurity operations role.
• Experience investigating endpoint and network security alerts using EDR and SIEM platforms.
• Working knowledge of ransomware attack patterns and common intrusion techniques.
• Hands-on experience investigating Linux and Windows systems.
• Experience analysing obfuscated scripts, malware behaviour, and performing deobfuscation to identify malicious activity.
• Familiarity with adversary tactics and techniques, and practical exposure to the MITRE ATT&CK framework.
• Experience analysing Windows Event Logs, Linux logs, and Active Directory fundamentals.
• Basic understanding of cloud and identity security investigations, including suspicious authentication activity and privileged account misuse.
• Ability to analyse network traffic, including TCP/IP, DNS, and HTTP/S.
• Scripting knowledge, including PowerShell; Python or other languages is mandatory.
• Strong documentation skills and attention to investigative detail.
• Security certifications such as Security+, CySA+, GCIH, or equivalent are a plus. Bachelor’s degree in Information Technology, Computer Science, or related field, or equivalent professional experience.
• Strong analytical and troubleshooting skills.
• Ability to manage multiple investigations in a fast-paced environment.
• Clear written and verbal communication skills.