Guardian Jobs
Security Operations Centre Analyst, GUARDIAN NEWS AND MEDIA
How your CV stacks up
Upload your CV to see how well it fits this job role
?%
Security Operations Centre Analyst, GUARDIAN NEWS AND MEDIA
Security Operations Centre Analyst at The Guardian
Join our team at The Guardian and be part of a diverse, inclusive, and global organisation that delivers fearless, investigative journalism and holds power to account. Our award-winning journalists, commercial professionals, and digital experts are committed to making a difference, with a broad range of backgrounds and perspectives. We offer an exciting, challenging environment focused on career development, training, and an inclusive culture.
The Role
We are seeking a Security Operations Centre (SOC) Analyst to join our Information Security team. The SOC Analyst will support the detection, investigation, and response to cyber security threats across The Guardian’s global digital estate. Working alongside the Security Operations Team, MSSP, and wider Security teams, the role will enhance operational security, improve threat visibility, and contribute to the evolution of Guardian security operations.
This position is ideal for a passionate security professional with a keen interest in threat detection, incident response, and security operations, eager to help build modern, intelligence-driven security capabilities.
- Location: London, UK
- Hours: 2pm–10pm UK time, Monday to Friday (US East Coast-focused)
- Working Model: Hybrid (3 days in office at Kings Cross, 2 days remote)
Key Responsibilities
- Triage, investigate, and respond to security alerts, events, and incidents—ensuring timely containment, remediation, and closure.
- Serve as the primary liaison with our MSSP, validating findings, improving service quality, and ensuring effective incident response.
- Conduct proactive threat hunting across endpoint, network, identity, and cloud environments to detect suspicious or malicious activity.
- Develop, tune, and optimise detection rules, SIEM use cases, and correlation logic to enhance threat visibility.
- Investigate security events in on-premise and cloud environments, including AWS, GCP, and Entra ID.
- Analyse threat intelligence, emerging threats, and incident trends to assess relevance to The Guardian’s threat landscape and refine detection strategies.
- Identify gaps in monitoring and detection coverage, recommending and implementing improvements based on intelligence and incident learnings.
- Support vulnerability prioritisation and remediation, correlating threat activity, exploitability, and business risk.
- Investigate and respond to Data Loss Prevention (DLP) alerts to mitigate data security incidents.
- Drive continuous improvement through:
- Automation
- Process optimisation
- Metrics and KPIs
- Post-incident reviews
- Updates to runbooks and playbooks
Reasons to use Rodeo
Start with a chat, not a search bar
Grad scheme, placement, apprenticeship? Not sure what you want yet — that's fine. Your agent talks it through with you and turns "I have no idea" into a shortlist.
It searches the market for you
Every day your agent scans the market matching roles against what actually matters to you, not just keywords on a CV.
Only hits
No noise. No "maybe this fits." Just roles with a clear explanation of why they're right — and where to focus when applying.
About You
To succeed in this role, we are looking for:
- Experience in a Security Operations Centre (SOC), incident response, or cyber security operations environment.
- Hands-on experience investigating security alerts and incidents using SIEM (e.g., Splunk), EDR (e.g., CrowdStrike, Sysmon), and other security tools.
- Ability to assess, prioritise, and respond to security incidents based on business risk and operational impact.
- Strong understanding of modern cyber threats and attack techniques, including familiarity with the MITRE ATT&CK framework.
- Cloud security experience (exposure to AWS, GCP, and identity platforms like Microsoft Entra ID).
- Knowledge of threat hunting, threat intelligence, and detection engineering.
- Analytical problem-solving skills, with the capability to:
- Interpret complex technical data
- Identify root causes
- Commitment to continuous learning, staying updated on emerging threats, technologies, and security best practices.
We particularly encourage applicants from groups traditionally underrepresented in UK media.
Why Join The Guardian?
Culture and Inclusivity: We believe diversity of thought drives innovation. The Guardian has ** achieved B Corp status**, the first major UK media organisation to do so, and prioritises inclusive hiring and development. We foster a workplace where everyone feels heard, supported, and empowered to contribute.
Get help with your application
Your very own career expert that helps elevate your application to the next level.
Our employee forums provide platforms for advocacy and collaboration, reflecting the voices of our global audience.
Wellbeing and Flexibility:
- Hybrid working: 3 days in office, 2 days remote.
- Flexible working requests welcomed for all roles.
- Accessible recruitment process—let us know how we can support you (contact Anna Vipers at anna.vipers@theguardian.com).
Benefits Package
- 30 days annual leave (plus bank holidays) + 5 optional extra days.
- Generous pension scheme: Contribute 5%, we contribute 8–12%.
- 2 paid volunteering days and payroll giving options.
- Tax-free season ticket loans.
- Dedicated private healthcare, life cover, income protection, eye tests.
- Dental insurance (optional).
- Enhanced parental leave policies, including:
- Maternity/paternity/adoption leave
- IVF support
- Menopause policy
- Baby loss policy
- Trans equality support
Career Growth and Development:
- Access to training, apprenticeships, and professional qualifications.
- Cutting-edge challenges with exposure to technical security, threat intelligence, and data-driven defences.
Built-in Rewards:
- Our canteen offers breakfast, lunch, and dinner with views of the Regent’s Canal.
- Free yoga and pilates classes; corporate gym membership; cycle-to-work scheme.
How to Apply
- Upload your CV—we don’t require a cover letter.
- You will be asked one question about cyber security (takes <5 mins to complete).
- Applications close: Friday 10 July 2026.
Every application is reviewed by our recruitment team—we do not use AI screening. Thank you for your time.
All roles at The Guardian are open to everyone. If you have accessibility needs or require adjustments to the application process, please contact Anna Vipers.
“It took my CV and asked me questions relevant to understanding what kind of jobs to suggest for me. Suggestions were almost perfect. Jobs were exactly what I’ve been looking for.”
Jessica, London
Skills
Location