Second Line Security Event Analyst

The NCI Agency is looking for a Second-Line Analyst to join its Cyber Security Operations Centre (CSOC), providing advanced monitoring, detection and escalation support across a 24/7 operational environment.

Duties

• Review and validate investigations, supporting First-Line Analysts to ensure that alert closures, escalations, supporting evidence and investigation notes meet CSOC quality standards, confirming completeness, accuracy and procedural compliance.
• Act as the technical escalation point for cyber-security monitoring.
• Perform in-depth log analysis and threat-triage using the SIEM and SOAR platforms (Splunk Enterprise Security, Splunk SOAR, Microsoft Sentinel) together with supporting data sources and security appliances, and decide whether to forward the case to Incident-Handling Officers.
• Provide on-call support as part of a 24/7 roster, delivering round-the-clock coverage for second-line escalations.
• Design, develop, test and maintain detection rules, alerts and analytics across the cyber-security monitoring tool-set.
• Continuously adjust logic, thresholds, allow-lists, suppression rules and severity mappings to reduce false positives and improve coverage of emerging threats.
• Provide regular, constructive feedback and coaching to First-Line Analysts on investigation techniques, analytical approach and reporting quality, and support the onboarding and training of new staff.
• Support the Duty Second-Line Analyst with weekly operational responsibilities, monitor open tasks, follow up on pending actions and highlight issues that could affect CSOC service continuity.
• Participate in purple teaming events within NCSC in order to test and improve CSOC's detection coverage.
• Collaborate with the Threat Hunting Team (CTIS) to operationalise their findings into automated detections where applicable.
• Contribute to continuous service improvement initiatives by identifying workflow inefficiencies, monitoring blind-spots and recommending process enhancements.
• Write and update operational documentation, SOPs, run-books and knowledge-base articles that underpin Service Delivery Management (SDM) and the wider CSOC team.
• Represent the CSOC during project planning, implementation and transition activities, ensuring that monitoring and visibility requirements are fully considered, and offer expertise on detection-content design, log-source integration and security-tool configuration for any cyber-security projects undertaken by the organisation.
• Collaborate with internal and external stakeholders, working closely with other Defend-branch sections and, when required, the wider NCI Agency.
• Perform other duties as required, including ad-hoc projects, special investigations or support activities that fall outside the listed responsibilities, to ensure the overall effectiveness and resilience of the CSOC.