Information Security Analyst - SecOps Response

Salary: £65,000 - 105,000 per year

Requirements:

• We require 3+ years experience in a cyber incident response and digital forensics function.
• We require experience handling incidents.
• We require experience in cloud forensics (GCP, AWS).
• We require experience in endpoint and server forensics (Windows, MacOS, Linux).
• We require experience in network forensics.
• We require experience with forensics data acquisition, disk forensics, and memory forensics.
• We require experience supporting and planning tabletop exercises.
• We require an understanding of network, cloud, and operating system security controls.
• We require excellent verbal and written communication skills, with the ability to communicate technical concepts to technical and non-technical audiences.
• We require demonstrated teamwork and collaboration skills as part of a multi-functional team.
• We require strong time management, problem-solving, and interpersonal skills.
• We require eagerness to learn and apply knowledge to new security challenges.
• We require willingness to share knowledge with the team and mentor colleagues.
• Preferred: experience with at least one programming or scripting language such as Python, Go, or Bash.
• Preferred: experience with container security.
• Preferred: experience conducting proactive threat hunting, defining hypotheses, and developing hunting methodologies.
• Preferred: understanding of malware analysis techniques.
• It would be great if we have one or more of the following qualifications, though they are not essential: GIAC Certified Forensic Analyst (GCFA), GIAC Cloud Forensics Responder (GCFR), GIAC iOS and macOS Examiner (GIME), 13cubed training in Windows, MacOS, or Linux DFIR, or similar training and certifications.

Responsibilities:

• We will conduct incident response activities to investigate and contain cyber security incidents.
• We will develop and maintain incident response and readiness processes.
• We will analyse logs from a variety of sources, including cloud, endpoint, and network, to identify root cause and determine next steps for containment, eradication, and recovery.
• We will plan and participate in tabletop exercises.
• We will document notes, analysis findings, containment steps, and the cause for each security incident.
• We will work with other teams across the organisation to analyse, contain, eradicate, and recover from cyber security incidents.
• We will present investigation findings to technical and non-technical audiences.
• We will support the wider SecOps team with detection engineering and threat hunting.

Technologies:

• AWS
• Bash
• Cloud
• GCP
• Support
• Linux
• macOS
• Network
• Python
• Security
• Windows
• iOS

More:

We are Starling, the UKs first and leading digital bank, on a mission to fix banking with fast technology, fair service, and honest values. We help customers spend, save, and manage their money while taking better care of the planet, and we have grown into a multi-award-winning bank with more than 2,800 people across offices in London, Cardiff, Dublin, Southampton, and Manchester. We are a fully licensed UK bank and a tech-first company at heart, operating with a flat, collaborative structure and an open culture. We offer hybrid working, with a minimum of 1 day per week in the office for Technology roles and a preference for a commutable distance to one of our offices. This Incident Responder role sits within our growing Security Operations team, supports our 24/7 operational capabilities on an on-call rota, and follows a Sunday to Thursday, 09:00 to 17:30 schedule. We offer benefits including 25 days holiday plus public holidays, a birthday day off, enhanced leave options, 16 hours of paid volunteering time, pension and life insurance, private medical insurance, family-friendly policies, Perkbox membership, and access to wellbeing, cycling, gym, and EV leasing initiatives.

last updated 36 week of 2026