G-Research is a leading quantitative research and technology firm, with offices in London and Dallas.
We are proud to employ some of the best people in their field and to nurture their talent in a dynamic, flexible and highly stimulating culture where world-beating ideas are cultivated and rewarded.
This role is based in our new Soho Place office – opened in 2023 - in the heart of Central London and home to our Research Lab.
The role
The Senior CSIRT Analyst will play a key role in G-Research’s Cyber Security Incident Response Team (CSIRT), specialising in cloud detection and response across AWS and hybrid environments.
You’ll investigate, respond to and proactively hunt for threats across a diverse technology landscape, including high-performance compute clusters, Kubernetes and containerised infrastructures, and corporate Windows environments.
You’ll leverage your expertise in cloud-native security tooling and multi-SIEM operations, such as Elastic, Azure and AWS, to strengthen our detection and response capabilities.
As a senior member of the team, you’ll participate in purple and red team exercises, continuously validating and improving the team’s effectiveness against advanced adversaries. Mentoring junior analysts, contributing to automation initiatives and supporting the on-call escalation rota for out-of-hours response will also be a key part of the role.
Key responsibilities for this role include:
Investigating, triaging and responding to complex security incidents across cloud (AWS, Azure), hybrid and on-premises environments
Proactively hunting for threats and developing detection logic to improve coverage across Elastic, Azure Sentinel and AWS Security Hub
Participating in red and purple team exercises to test, validate and enhance detection and response capabilities
Developing and maintaining automation and orchestration workflows in Tines and Python to streamline investigation and response
Collaborating with engineering teams to improve log ingestion, detection rules and platform reliability
Providing mentorship and technical guidance to junior CSIRT analysts
Supporting and participating in the on-call escalation rota for out-of-hours incidents
Contributing to continuous improvement of CSIRT processes, playbooks and threat models.
Who are we looking for?
The ideal candidate will ahve the following skills and experience:
Significant experience in cyber incident response, detection engineering and/or SOC/CSIRT operations
Strong expertise in cloud security within AWS and Azure, with hands-on experience investigating incidents in cloud environments
Proficiency with SIEM platforms, such as Elastic Security, Azure Sentinel, AWS Security Hub or GuardDuty, and log analysis.
Experience working with red and purple team exercises and adversary simulation
Knowledge of containerised environments, including Kubernetes and Docker, and cloud-native infrastructure security
Programming and scripting experience, preferably in Python, and exposure to automation platforms such as Tines and SOAR
Strong understanding of modern attack techniques, threat actors and the MITRE ATT&CK framework
Prior mentoring, coaching or senior technical leadership experience within a security operations context
Behavioural Competencies:
Analytical Thinking: The ability to investigate complex threats, synthesise data from multiple sources and identify root causes.
Resilience: Comfortable operating in high-pressure environments and responding to incidents in real time
Collaboration: The ability to work closely with engineering, operations and leadership teams to improve overall security posture
Innovation: Enthusiastic about automating workflows and experimenting with new detection and response approaches
Leadership: The ability to guide junior analysts, foster team growth and promote a culture of continuous improvement
Who should you apply?
Highly competitive compensation plus annual discretionary bonus
Lunch provided (via Just Eat for Business) and dedicated barista bar
30 days’ annual leave
9% company pension contributions
Informal dress code and excellent work/life balance
Comprehensive healthcare and life assurance
Cycle-to-work scheme
Monthly company events
