Principal Attack Monitoring Analyst (GSOC)

About the role

LSEG Security Operations monitors, detects, investigates and responds to cyber security threats and incidents. As a senior member of the Attack Monitoring team, you will provide technical leadership for investigations, support analyst development and identify ways to improve detection and response. You will work closely with Incident Response teams, escalating significant incidents while keeping ownership of technical investigations.

Key responsibilities

• Act as the primary technical escalation point for cyber security alerts managed by the team.
• Lead complex investigations and provide hands-on technical analysis across a wide range of alerts.
• Serve as a senior technical leader and subject matter expert for Attack Monitoring analysts.
• Coach, mentor and develop analysts to strengthen investigative capabilities.
• Assess incidents to decide when escalation to Incident Response is needed, working with Incident Response teams on handover.
• Review alert volumes, trends and investigation outcomes to improve detection fidelity and reduce false positives.
• Partner with stakeholders to recommend improvements to detection, monitoring, triage and response.
• Identify workflow improvements through automation and process optimisation.
• Develop and maintain investigation playbooks, alert guides and knowledge articles.

Required profile

• Significant experience in a SOC, Threat Detection and Monitoring, Incident Response, Digital Forensics or a related cyber security function.
• Proven experience conducting end-to-end investigations and coaching technical teams.
• Track record of improving operations through automation and subject matter expertise.
• Preferred: experience in global financial services or highly regulated environments; industry-recognised certifications such as GIAC, SANS, CREST, GCFA, GCIH or GNFA; scripting or programming experience; security automation and orchestration experience.

Required skills

• Deep understanding of adversary TTPs and advanced knowledge of Windows, Linux, Unix and macOS.
• Enterprise investigation across endpoint, network, identity and cloud, plus log analysis.
• Knowledge of AWS, Azure, GCP and Microsoft 365.
• Strong knowledge of SOC practices and incident response frameworks such as NIST or SANS.
• Excellent communication of technical concepts to technical and non-technical audiences.