Senior Incident Response Analyst (VP)

Contract to Permanent

Global Investment Bank

Location: London (4 days per week in office)

We are supporting a global investment bank in the search for a Senior Incident Response Analyst (VP) to join their Global Incident Response function. The role sits within a highly experienced cyber security team and will be responsible for investigating and responding to security incidents across both the banking and securities businesses. You will take ownership of incidents ranging from initial triage through to containment, eradication, recovery and post-incident review. This is a hands-on role suited to an experienced Incident Response professional who enjoys technical investigations, threat analysis and working across complex enterprise environments.

Key Responsibilities

• Lead and support the investigation of low to high-severity cybersecurity incidents
• Conduct incident triage, investigation, containment, eradication and recovery
• Investigate security alerts and suspicious activity to determine scope, impact, root cause and remediation requirements
• Perform detailed threat and forensic analysis using SIEM, EDR, network telemetry and threat intelligence
• Analyse endpoint and network activity, including packet captures and endpoint telemetry
• Develop detailed incident timelines, collect and preserve evidence, and maintain investigation documentation
• Apply knowledge of attacker TTPs and MITRE ATT&CK to identify and investigate malicious activity
• Escalate significant or business-impacting incidents and support major incident and crisis response activities
• Provide technical guidance and support to SOC analysts and other Incident Response team members
• Develop and continuously improve Incident Response playbooks, workflows and escalation procedures
• Participate in post-incident reviews and lessons-learned sessions
• Work closely with SOC, Threat Intelligence, Threat Hunting, Cyber Security and Infrastructure teams
• Collaborate with global Incident Response teams on cross-regional investigations and response activities
• Ensure incident response activities align with relevant regulatory and security standards
• Participate in an on-call and out-of-hours incident response rotation