Security Analyst (3rd Line)

- Act as the technical lead for the investigation of security incidents across supported platforms. - Investigate malware, ransomware, account compromise, unauthorized access, suspicious activity, and security misconfiguration. - Perform detailed root cause analysis across endpoint, identity, network, and application layers. - Advise the Incident Manager on incident scope, impact, containment, eradication strategy, and recovery validation. - Drive incidents through to full technical resolution, avoiding temporary mitigation. - Investigate vulnerabilities identified via scanning platforms, endpoint and cloud tooling, supplier disclosures, and audit activity. - Assess risk based on exploitability, exposure, and operational impact. - Own remediation actions end-to-end, coordinating with Infrastructure, Network, and third-party suppliers. - Validate remediation and ensure appropriate evidence is captured for assurance and audit. - Produce clear, technically accurate documentation covering incidents, root cause analysis, and corrective actions. - Support governance, customer assurance, and audit requirements. - Contribute to post-incident reviews and lessons learned. - Identify recurring issues and recommend long-term improvements. - Ensure incidents and vulnerabilities are correctly logged and tracked within ITSM systems. - Work closely with Incident Managers, Security specialists, and Level 3 Infrastructure and Network teams. - Act as a senior escalation point for Level 1 and Level 2 teams. - Engage third-party suppliers to progress investigation and remediation. - Participate in out-of-hours response as required.