Job Category: Cybersecurity & Information Security
Job Title: Cybersecurity Analyst / Information Security Analyst
Experience: Entry Level to Senior
Location: United Kingdom
Job Type: Full-Time
Work Mode: On-Site, Hybrid or Remote, depending on employer and project requirements
Job Overview
Cybersecurity Analysts help organisations protect applications, networks, systems, endpoints and data from security threats. These roles involve monitoring security events, investigating suspicious activity, responding to incidents and improving security controls.
Cybersecurity Analyst jobs in the UK are available across technology, financial services, healthcare, retail, telecom, consulting, manufacturing, government and other sectors. Depending on experience, professionals may work with SIEM, EDR/XDR, vulnerability management, identity security, cloud security, network security and incident response.
Key Responsibilities
- Monitor security alerts, logs and events across networks, endpoints, applications and cloud environments.
- Investigate suspicious activities, security alerts and potential cyber incidents.
- Perform initial incident triage and support incident response activities.
- Analyse security logs and identify indicators of compromise.
- Escalate confirmed or high-risk incidents according to security procedures.
- Investigate phishing emails, malware alerts, unauthorised access and suspicious network activity.
- Support vulnerability assessments and remediation tracking.
- Review security configurations across systems, applications and cloud platforms.
- Monitor endpoint and network security controls.
- Assist with security investigations, root-cause analysis and incident documentation.
- Maintain security reports, incident records and investigation documentation.
- Work with infrastructure, networking, cloud, application and IT teams to resolve security issues.
- Support security audits, compliance activities and internal security assessments.
- Contribute to security policies, procedures and operational improvements.
- Stay informed about emerging threats, vulnerabilities and attack techniques.
Security Monitoring & SIEM
Experience with security monitoring platforms is valuable for Cybersecurity Analyst roles.
Common technologies include:
- Microsoft Sentinel
- Splunk
- IBM QRadar
- Elastic Security
- LogRhythm
- Sumo Logic
- Microsoft Defender
- Security Operations Centre (SOC) platforms
Candidates may be expected to analyse:
- Authentication logs
- Windows and Linux logs
- Firewall events
- VPN activity
- Endpoint alerts
- Cloud security events
- Email security alerts
- Application logs
- Network traffic
- Identity and access events
Endpoint Security & EDR
Cybersecurity Analysts may work with endpoint detection and response technologies such as:
- Microsoft Defender for Endpoint
- CrowdStrike Falcon
- SentinelOne
- Sophos
- VMware Carbon Black
Responsibilities can include investigating malware detections, suspicious processes, endpoint compromise, abnormal behaviour and unauthorised software.
Incident Response
Analysts may support the full incident response lifecycle, including:
- Alert validation
- Incident triage
- Evidence collection
- Threat investigation
- Containment support
- Eradication activities
- Recovery coordination
- Root-cause analysis
- Incident reporting
- Post-incident improvement
Knowledge of common attack techniques, phishing, malware, credential attacks, privilege escalation and lateral movement is useful.
Network Security
A strong understanding of networking is important for many cybersecurity positions.
Knowledge may include:
- TCP/IP
- DNS
- HTTP/HTTPS
- VPN
- Firewalls
- Proxies
- IDS/IPS
- Network segmentation
- Secure remote access
- Routing and switching fundamentals
- Network traffic analysis
Experience with technologies such as Cisco, Palo Alto Networks, Fortinet or similar security platforms can be useful depending on the role.
Vulnerability Management
Cybersecurity Analysts may assist with identifying and managing vulnerabilities across infrastructure and applications.
Relevant activities include:
- Vulnerability scanning
- Risk assessment
- CVE analysis
- Patch validation
- Remediation tracking
- Security configuration reviews
- Vulnerability reporting
- Working with infrastructure and application teams on remediation
Tools such as Tenable, Qualys, Rapid7 or similar vulnerability management platforms may be used.
Identity & Access Security
Understanding identity and access management is increasingly important across enterprise environments.
Relevant areas include:
- Active Directory
- Microsoft Entra ID
- Identity and access management
- Multi-factor authentication
- Privileged access management
- Role-based access control
- Single sign-on
- Conditional access
- Account monitoring
- Access reviews
Cloud Security
Cloud security experience is valuable for analysts working with modern infrastructure.
Depending on the employer, candidates may work with:
AWS
- IAM
- CloudTrail
- GuardDuty
- Security Hub
- VPC security
- CloudWatch
Microsoft Azure
- Microsoft Entra ID
- Microsoft Defender for Cloud
- Microsoft Sentinel
- Azure Monitor
- Network security
- Key Vault
Google Cloud
- IAM
- Security Command Center
- Cloud Logging
- VPC security
- Cloud Monitoring
Knowledge of cloud identity, access control, logging, encryption, network security and security monitoring is beneficial.
Threat Intelligence
Analysts may use threat intelligence to understand and investigate potential attacks.
Relevant areas include:
- Indicators of compromise
- IP addresses
- Domains
- URLs
- File hashes
- Malware intelligence
- Threat actor techniques
- MITRE ATT&CK
- Tactics, techniques and procedures (TTPs)
- Threat intelligence feeds
Security Tools & Technologies
Depending on the position, candidates may work with:
- SIEM platforms
- EDR/XDR platforms
- Firewalls
- IDS/IPS
- Vulnerability scanners
- Email security solutions
- DLP tools
- IAM platforms
- Cloud security tools
- Network monitoring tools
- Ticketing and incident management systems
Knowledge of security frameworks such as NIST Cybersecurity Framework, ISO 27001 and CIS Controls can also be useful.
Scripting & Technical Skills
Basic scripting can help automate investigations and security operations.
Useful technologies include:
- Python
- PowerShell
- Bash
- SQL
- Regular expressions
- JSON
- REST APIs
Candidates may use scripting to analyse logs, automate repetitive security tasks, query APIs or support incident investigations.
Experience Levels
Entry-Level Cybersecurity Analyst
Entry-level candidates may have:
- Basic understanding of cybersecurity principles.
- Knowledge of networking, operating systems and security fundamentals.
- Understanding of common cyber threats and attack techniques.
- Familiarity with SIEM or security monitoring concepts.
- Basic knowledge of Windows and Linux.
- Understanding of authentication, access control and encryption.
- Exposure to vulnerability scanning or security labs.
- Basic Python, PowerShell or Bash knowledge is beneficial.
- Relevant academic projects, internships or security certifications can be useful.
Mid-Level Cybersecurity Analyst
Mid-level professionals may be expected to:
- Independently investigate security alerts and incidents.
- Analyse SIEM and endpoint security data.
- Perform incident triage and escalation.
- Investigate phishing, malware and suspicious authentication activity.
- Work with vulnerability management processes.
- Analyse network and endpoint logs.
- Support cloud security monitoring.
- Create investigation reports and security documentation.
- Participate in incident response and root-cause analysis.
- Work with infrastructure, cloud and application teams.
- Improve security monitoring rules and operational processes.
Senior Cybersecurity Analyst
Senior Cybersecurity Analysts may handle more complex security investigations and operational responsibilities.
Typical responsibilities include:
- Lead investigations into complex security incidents.
- Perform advanced SIEM, endpoint and network analysis.
- Develop and improve detection rules and security monitoring processes.
- Conduct threat hunting activities.
- Support incident response and containment strategies.
- Analyse attack techniques using frameworks such as MITRE ATT&CK.
- Improve security controls across enterprise environments.
- Support security architecture and risk assessments.
- Mentor junior cybersecurity analysts.
- Coordinate with SOC, infrastructure, cloud, network and application security teams.
- Contribute to security standards, procedures and incident response playbooks.
Education & Certifications
A degree or equivalent qualification in one of the following may be relevant:
- Cybersecurity
- Information Security
- Computer Science
- Information Technology
- Network Security
- Computer Engineering
- Software Engineering
- Related technical discipline
Relevant certifications may include:
- CompTIA Security+
- CompTIA CySA+
- Microsoft security certifications
- Certified Ethical Hacker (CEH)
- GIAC certifications
- CISSP for experienced security professionals
- Other recognised cybersecurity and cloud security certifications
Certification requirements vary by employer and experience level.
UK Locations
Cybersecurity Analyst opportunities may be available across the UK, including:
- London
- Manchester
- Birmingham
- Cambridge
- Bristol
- Leeds
- Edinburgh
- Glasgow
- Reading
- Oxford
- Nottingham
- Liverpool
- Belfast
- Other UK locations
Industries Hiring Cybersecurity Analysts
Cybersecurity professionals may find opportunities across:
- Technology and software
- Financial services
- Banking
- Insurance
- Healthcare
- Telecommunications
- Retail and e-commerce
- Manufacturing
- Consulting
- Cloud and SaaS
- Professional services
- Energy and utilities
- Enterprise IT
Common Job Titles
Job opportunities may be listed under titles such as:
- Cybersecurity Analyst
- Cyber Security Analyst
- Information Security Analyst
- SOC Analyst
- Security Operations Analyst
- Security Analyst
- Cyber Defence Analyst
- Threat Analyst
- Incident Response Analyst
- Security Monitoring Analyst
- Vulnerability Analyst
- Cloud Security Analyst
- Senior Cybersecurity Analyst
- Senior Information Security Analyst
Candidate Profile
Employers may look for candidates with strong analytical and problem-solving abilities, attention to detail and an understanding of cybersecurity operations. Experience with security monitoring, incident investigation, endpoint security, vulnerability management, networking or cloud security can be valuable depending on the position.
Candidates should highlight relevant cybersecurity projects, tools, certifications, technical skills and professional experience in their CV.
Apply for Cybersecurity Analyst Jobs in UK
Candidates looking for Cybersecurity Analyst jobs in the UK can explore opportunities ranging from entry-level SOC and security monitoring positions to mid-level incident response and vulnerability roles and senior cybersecurity positions.
Submit an updated CV highlighting your cybersecurity skills, security tools, certifications, projects and relevant experience for suitable opportunities across the UK.