Cyber Security Incident Response Analyst

Join us, be part of more. We’re so much more than an energy company. We’re a family of brands revolutionising how we power the planet. We're energisers. One team of 21,000 colleagues that's energising a greener, fairer future by creating an energy system that doesn’t rely on fossil fuels, whilst living our powerful commitment to igniting positive change in our communities.

Here, you can find more purpose, more passion, and more potential. That’s why working here is #MoreThanACareer.

We do energy differently - we do it all. We make it, store it, move it, sell it, and mend it.

An opportunity to play your part - Ready to be on the frontline of cyber defence?

At Centrica, we're looking for a talented Cyber Security Incident Response Analyst to join our Cyber Security Incident Response Team (CSIRT).

Location:

UK-based hybrid role, Occasional travel to site.

Day to day

• Lead and support cyber security incident investigations across Centrica, analysing and responding to threats ranging from phishing and credential compromise to ransomware, data loss and complex security events.
• Manage incidents throughout the full response lifecycle, coordinating containment, eradication, recovery and post-incident activities while ensuring stakeholders remain informed and aligned.
• Conduct technical investigations using SIEM, EDR, cloud, identity, email and network security tools to determine scope, impact and root cause across enterprise and cloud environments.
• Support forensic investigations and evidence handling activities, ensuring robust documentation, evidence preservation and clear reporting for technical, legal and governance purposes.
• Investigate threats across modern technology platforms, including AWS, Azure, SaaS applications, code repositories, CI/CD pipelines and Operational Technology (OT) environments, working closely with engineering and technology teams.
• Drive continuous improvement by contributing to incident response playbooks, tabletop exercises, detection enhancements and lessons learned activities, helping Centrica stay one step ahead of emerging cyber threats.

What are the must haves

• Proven experience in Cyber Security Operations, Incident Response, Threat Hunting, Digital Forensics or Cloud Security, with a strong understanding of the end-to-end incident response lifecycle.
• Strong analytical and investigative skills, with the ability to correlate logs and security data from multiple sources using SIEM, EDR and identity platforms to quickly identify threats and assess impact.
• Knowledge of forensic principles, evidence handling and defensible investigation practices, ensuring incidents are documented clearly and accurately from start to finish.
• Good understanding of modern technology environments, including cloud platforms, SaaS applications, identity services, GitHub and code repositories, alongside awareness of evolving cyber threats and attacker techniques.
• Excellent communication and stakeholder management skills, able to translate technical findings into clear, actionable updates for both technical and non-technical audiences while collaborating across multiple teams.
• A naturally curious, calm and resilient approach, with sound judgement, strong integrity and a passion for continuous improvement, helping us strengthen our cyber defences and stay ahead of emerging threats.