Queue Management – day-to-day management of the security incident/service request queue in alignment with SLA.
Security Incident Response & Digital Investigations – Providing timely analyst services to aid the technical investigation of security incidents. Establishing root causes, patterns and solutions for re-securing systems and networks.
Threat Hunting & Protective Monitoring
Assisting with investigating alerts generated by security systems and raising incidents based on indicators of compromise.
Vulnerability Assessment & Management – assist with and follow KSC vulnerability management processes. Regularly reporting upon and formally identifying key vulnerabilities, advising colleagues as necessary on remediation activities. Keeping proactively up to date with current & emerging threats and exploits which may impact on the KCL environment.
Continuous Technical Improvement – assisting with ongoing development of King’s technical protection investments including but not limited IPS/IDS, firewalls and end user protections.
Availability to cover security on-call as required.
Undertake such other duties within the scope of the post as may, from time to time, be assigned by the Cyber Security Operations or Cyber Security Development manager to ensure the Confidentiality, Integrity, Availability and more general effective operational running of the KCL environment.

1 year+ real world technical security experience within a professional IT environment. (E)
Knowledge of security related technologies such as firewalls, proxy servers, IPS/IDS, SIEM, endpoint protections. (E)
Proactive interest in industry developments and cybersecurity solutions. (E)
Excellent general IT skills and knowledge including contemporary Microsoft solutions, networking and/or applications. (E)
Awareness of recognised security standards and architectural patterns e.g. SANS, CIS, NIST, NCSC and/or PCI-DSS. (D)
ITIL awareness is essential, foundation or higher certification highly desirable. (D)
Experience of investigation and remediation of security incidents. (D)
Holds or is actively working towards a recognised security certification i.e. SSCP, CompTIA S+(D)

Cyber Security Analyst

Key skills