CySOC Analyst

We’ll inspire and empower you to deliver your best work so you can evolve, grow and succeed – today and into tomorrow. We offer an exciting range of opportunities to develop your career within a supportive and diverse team who always strive to do the right thing for our people, clients and communities. People are our greatest asset, and we offer a competitive package to retain and attract the best talent. In addition to the benefits you’d expect, UK employees also receive free single medical cover and digital GP service, family-friendly benefits such as enhanced parental leave pay and free membership of employee assistance and parental programmes, plus reimbursement towards relevant professional development and memberships. We also give back to our communities through our Collectively program which incorporates matched-funding, paid volunteering time and charitable donations. Work-life balance and flexibility is a key focus area for us. We’re happy to discuss hybrid, part-time and flexible working hours, patterns and locations to suit you and our business. About the Opportunity: Amentum is seeking a talented and motivated CySOC Analyst to join our growing cyber security team. In this role, you will play a critical part in protecting operational technology (OT) environments that underpin essential services and infrastructure. Working within a fast-paced and collaborative Security Operations environment, you will be responsible for proactively monitoring systems, identifying potential threats, and supporting the response to cyber security incidents. Your work will directly contribute to safeguarding critical systems, maintaining operational resilience, and reducing organisational risk. This is an exciting opportunity to develop your expertise in cyber security operations while working with modern tools, threat intelligence, and a team dedicated to continuous improvement and innovation. This role is based at our Warrington site and involves working onsite on a full-time basis. Key Responsibilities: Proactively monitor security tools and SIEM platforms to detect and investigate suspicious activity. Triage and analyse security alerts across network and system environments. Identify anomalies and potential threats through log and behavioural analysis. Support incident response activities, including containment, remediation, and recovery. Escalate high-risk events in line with established procedures. Conduct vulnerability and risk analysis to identify weaknesses and emerging threats. Contribute to the tuning and optimisation of SIEM rules and detection capabilities. Support compliance, audit, and security assurance activities. Produce clear, concise reports on incidents, trends, and risks. Collaborate with IT, engineering, and cyber teams to improve security processes and playbooks. Here's What You'll Need: A degree in Cyber Security, Computer Science, Information Technology, or a related field, or equivalent practical experience. Experience in cyber security, IT, or a related technical role, or a combination of education and hands-on experience. An understanding of security operations, including monitoring, threat detection, and incident response. Knowledge of network architectures, common vulnerabilities, and security best practices. Awareness of risk, compliance, and security standards within Defence or other regulated environments (e.g. JSP 440, JSP 453). Experience working with security technologies such as SIEM, IDS/IPS, or endpoint protection tools. Ability to monitor and analyse security events, investigate alerts, and assess their potential impact. Confidence identifying and escalating potential threats, with experience supporting incident response activities such as containment and recovery. Understanding of vulnerability management, including identifying system weaknesses and configuration issues. Familiarity with threat intelligence and how it can be used to support security analysis and risk assessment. Experience contributing to risk assessments and supporting the implementation or validation of security controls. Ability to produce clear, accurate reports and communicate effectively with both technical and non-technical stakeholders. Familiarity with recognised security frameworks such as MITRE ATT&CK, NIST, or ISO 27001 would be beneficial. Experience or interest in areas such as threat hunting, SIEM optimisation, or attacker tactics and techniques (TTPs) is advantageous. Awareness of operational technology (OT) or industrial control systems (ICS) environments is beneficial. Strong analytical thinking and problem-solving skills, with the ability to manage and prioritise multiple tasks. Clear communication skills and a structured, detail-focused approach to work. Our Culture: Our values stand on a foundation of safety, integrity, inclusion and diversity. We put people at the heart of our business, and we genuinely believe that we all succeed by supporting one another through our culture of caring. We value positive mental health and a sense of belonging for all employees. We aim to embed inclusion and diversity in everything we do. We know that if we are inclusive, we’re more connected, and if we are diverse, we’re more creative. We accept people for who they are, regardless of age, disability, gender identity, gender expression, marital status, mental health, race, faith or belief, sexual orientation, socioeconomic background, and whether you’re pregnant or on family leave. This is reflected in our wide range of Global Employee Networks centered on inclusion and diversity. We partner with VERCIDA to help us attract and retain diverse talent. For greater online accessibility, please visit www.vercida.com to view and access our roles. As a Disability Confident employer, we will interview all disabled applicants who meet the minimum criteria for a vacancy. We welcome applications from candidates who are seeking flexible working and from those who may not meet all the listed requirements for a role. If you require further support or reasonable adjustments with regards to the recruitment process (for example, you require the application form in a different format), please contact us. Welcome back! We encourage you to check on the status of your current job applications with us. You can also search for a list of our current job openings and see if there are any new positions that might be a good fit for you. Thank you for continued interest in employment with Amentum. For more than 100 years, Amentum has tackled the world’s toughest challenges to deliver agile and steadfast solutions to the U.S. government and its allies. With more than 50,000 employees on all seven continents and in more than 60 countries, Amentum delivers a broad range of operational support services to meet the critical needs of our clients. Our headquarters are in Chantilly, VA. Find us online at https://www.amentum.com/ If you need a reasonable accommodation for any part of the employment process, please contact us by email at TAOps@amentum.com and let us know the nature of your request and your contact information. Requests for accommodation will be considered on a case-by-case basis. If you need assistance, please reach out to workdaycandidateaccounts@amentum.com EEO including Disability/Protected Veterans Labor Laws Posters Amentum has become aware of unauthorized individuals who are falsely using the Amentum name and /or logo in an attempt to solicit fees from potential job seekers. These deceptive and unauthorized individuals are soliciting money, promising placement in a position with Amentum. Please note any communication requesting any amount of money in exchange for employment with Amentum is fraudulent. These communications do not originate from Amentum and are not associated with the recruitment process. Amentum and its affiliates never charge candidates fees or payments of any kind in order to secure employment. As a precaution, we recommend you do not disclose personal or financial details to anyone as a response to an unsolicited email, social media, or dating website request. Amentum will never as ask for a placement fee or any other fee to expedite the hiring process. If you are contacted by anyone offering employment with Amentum, you should never be asked to pay a fee for recruiting. Amentum personnel will always send email from an identifiable corporate account (ending in @amentum.com) and never from a public email account like Yahoo!, Google, Gmail, or Hotmail. If you are contacted regarding a fraudulent employment proposal, we encourage you to alert your local law enforcement agency/police authority. To read more about Amentum’s commitment to ethics, please click here.