Information Security Analyst - SecOps Detection

Salary: £65,000 - 105,000 per year

Requirements:

• We require 3+ years in a technical security role such as detection engineering, threat hunting, incident response, or threat intelligence.
• We require practical experience analysing attacker behaviour and applying threat analysis models like MITRE ATT&CK to prioritise and enhance detective controls.
• We require hands-on experience with SIEM platforms such as Splunk, Google SecOps, Elastic, or Sentinel for rule/query creation and analytics.
• We require experience conducting proactive threat hunts, defining hypotheses, and developing hunting methodologies.
• We require solid knowledge of security risks and detection strategies for AWS, GCP, and Azure.
• We require experience with EDR tools such as CrowdStrike, SentinelOne, or Cortex XDR.
• We require a good understanding of OS internals across macOS, Linux, and Windows, as well as network security principles.
• We require excellent analytical, problem-solving, and communication skills.
• We require a self-starter who can lead projects and work collaboratively.
• We require a growth mindset and eagerness to learn and apply knowledge to new security challenges.
• Preferred: experience with at least one programming or scripting language such as Python, Go, or Bash for security automation or analysis.
• Preferred: experience with container security monitoring using Docker or Kubernetes.
• Preferred: experience with Detection-as-Code.
• Preferred: experience with SOAR platforms.
• Preferred: knowledge of digital forensics and incident response procedures.
• Preferred: understanding of malware analysis techniques.
• Preferred qualifications include GIAC Certified Forensic Analyst (GCFA), GIAC Cloud Threat Detection (GCTD), or GIAC iOS and macOS Examiner (GIME).

Responsibilities:

• We design, build, test, and maintain high-fidelity detection rules and analytics in our SIEM and other security platforms.
• We formulate hypotheses and hunt for undetected attacker TTPs across our cloud, SaaS, and endpoint environments.
• We collaborate with our Adversarial Simulation team in Purple Team exercises to test, validate, and improve detection logic and response.
• We act as a Subject Matter Expert during security incidents, providing deep technical analysis and aiding remediation.
• We integrate and operationalise threat intelligence to inform detection strategies and hunting projects.
• We work closely with the wider Security Operations team and other stakeholders to uplift our security posture and improve detective controls.
• We maintain clear documentation for detection rules, hunting playbooks, and processes.

Technologies:

• AWS
• Azure
• Bash
• Cloud
• Docker
• GCP
• Kubernetes
• Linux
• macOS
• Network
• Python
• Security
• Splunk
• Windows
• iOS
• Support

More:

We are Starling, the UKs first and leading digital bank, on a mission to fix banking with fast technology, fair service, and honest values. We are a fully licensed UK bank and a tech-first company with over 2,800 colleagues across offices in London, Cardiff, Dublin, Southampton, and Manchester. Our Security Operations team works in a fast-paced, collaborative, flat-structure environment where innovation, ownership, and knowledge sharing are central. This role is hybrid, with a preference for candidates within commutable distance of one of our offices and, in Technology, at least one day per week in the office. We offer 25 days holiday plus public holidays, a birthday day off, enhanced pension, life insurance, private medical insurance, family-friendly policies, volunteering time, and access to wellbeing and lifestyle benefits. We are an equal opportunity employer committed to diversity and inclusion.

last updated 36 week of 2026