Principal Attack Monitoring Analyst (GSOC)

About the role

LSEG Security Operations monitors, detects, investigates and responds to cyber security threats and incidents. As a senior member of the Attack Monitoring team, you will provide technical leadership for investigations, support analyst development and identify ways to improve detection and response. You will work closely with Incident Response teams, escalating significant incidents while keeping ownership of technical investigations.

Key responsibilities

• Act as the primary technical escalation point for cyber security alerts managed by the team.
• Lead complex investigations and provide hands-on technical analysis across a wide range of alerts.
• Serve as a senior technical leader and subject matter expert for Attack Monitoring analysts.
• Coach, mentor and develop analysts to strengthen investigative capabilities.
• Assess incidents to decide when escalation to Incident Response is needed, working with Incident Response teams on handover.
• Review alert volumes, trends and investigation outcomes to improve detection fidelity and reduce false positives.
• Partner with Security Operations stakeholders to improve detection, monitoring, triage and response processes.
• Identify workflow improvements through automation and process optimisation, supporting implementation teams.
• Develop and maintain investigation playbooks, alert guides and knowledge articles based on incident learnings and threat intelligence.

Required profile

• Significant experience in a SOC, Threat Detection and Monitoring, Incident Response, Digital Forensics or a related cyber security function.
• Proven experience conducting end-to-end investigations and coaching and developing technical teams.
• Track record of improving operations through automation and subject matter expertise.
• Deep understanding of modern adversary TTPs and strong knowledge of SOC practices and incident response frameworks such as NIST or SANS.
• Excellent communication skills, able to explain technical concepts to technical and non-technical audiences.

Required skills

• Advanced knowledge of Windows, Linux, Unix and macOS, including their artefacts and file systems.
• Enterprise environment investigation across endpoint, network, identity and cloud technologies.
• Log analysis across operating systems, network infrastructure, cloud platforms and security tools.
• Preferred: experience in global financial services or highly regulated environments, industry-recognised certifications (GIAC, SANS, CREST, GCFA, GCIH, GNFA), scripting or programming experience, security automation and orchestration tools, and a calm approach to high-pressure incidents.