Security Incident Response Analyst

Technology is our how. And people are our why. For over two decades, we have been harnessing technology to drive meaningful change.

 

By combining world-class engineering, industry expertise and a people-centric mindset, we consult and partner with leading brands from various industries to create dynamic platforms and intelligent digital experiences that drive innovation and transform businesses.

 

From prototype to real-world impact - be part of a global shift by doing work that matters.

The Incident Response Analyst is part of the front line of our Cyber Threat Intelligence and Incident Response team, responsible for providing Endava with high fidelity, actionable cyber threat intelligence and specialist incident response capabilities.

Strong knowledge of the latest security threats, industry standard incident response methodologies, and investigation techniques is expected. Candidates should also demonstrate adaptability, knowledge of both incident response and cyber threat intelligence, and an eagerness to learn emerging threat actor tactics, tools and techniques.

Responsibilities:

• Act as a key responder during security incidents, supporting containment, eradication and recovery activities.
• Perform detailed investigation and analysis of security alerts, intrusions and malware using EDR, SIEM and forensic tooling.
• Support post-incident reviews, identifying root cause, control gaps and lessons learned.
• Coordinate with SOC, CTI, IT, legal and third-party providers during incidents to ensure timely and effective response
• Support evidence collection and documentation to meet legal, regulatory and internal reporting requirements.

 

In periods without active incident response activity, the analyst will actively support Cyber Threat Intelligence operations and initiatives

• Degree in Cyber Security, Computer Science, Information Technology or a related discipline, or equivalent practical experience.
• Relevant incident response, blue team or security operations certification (for example GCIH, GCED, or equivalent).
• Demonstrated experience responding to security incidents, labs or realistic tabletop exercises.

Experience:

• 3+ years in cybersecurity, with at least 2 years in SOC/CTI/Incident Response.
• Hands-on experience in malware analysis, memory forensics, and log analysis.
• Strong understanding of network protocols, secure configurations, and common attack techniques (MITRE ATT&CK).
• Experience supporting or participating in security incident response activities, including investigation and containment.
• Familiarity with SOC tooling such as SIEM, EDR, Threat Intelligence Platforms and alerting platforms.
• Experience analysing security alerts, logs and endpoint telemetry to identify malicious activity.
• Experience documenting incidents, investigations and lessons learned in a clear and structured manner.

Technical Skills:

• Hands-on experience with SIEM and EDR tools for alert investigation and incident analysis.
• Ability to analyse endpoint, network and log data to identify malicious activity.
• Familiarity with incident response processes, including triage, containment and recovery.
• Basic malware analysis and investigation skills, such as analysing file hashes, URLs and suspicious processes.
• Understanding of common attack vectors, vulnerabilities and exploitation techniques.

Additional Skills:

• Strong problem-solving and analytical skills.
• Ability to remain calm and decisive during high-pressure incidents.
• Excellent communication skills, both technical and non-technical.
• Continuous learning mindset and willingness to explore new tools and methods.

Discover some of the global benefits that empower our people to become the best version of themselves:

• Finance: Competitive salary package, share plan, company performance bonuses, value-based recognition awards, referral bonus;   
• Career Development: Career coaching, global career opportunities, non-linear career paths, internal development programmes for management and technical leadership;
• Learning Opportunities: Complex projects, rotations, internal tech communities, training, certifications, coaching, online learning platforms subscriptions, pass-it-on sessions, workshops, conferences;
• Work-Life Balance: Hybrid work and flexible working hours, employee assistance programme;
• Health: Global internal wellbeing programme, access to wellbeing apps;
• Community: Global internal tech communities, hobby clubs and interest groups, inclusion and diversity programmes, events and celebrations.

At Endava, we’re committed to creating an open, inclusive, and respectful environment where everyone feels safe, valued, and empowered to be their best. We welcome applications from people of all backgrounds, experiences, and perspectives—because we know that inclusive teams help us deliver smarter, more innovative solutions for our customers. Hiring decisions are based on merit, skills, qualifications, and potential. If you need adjustments or support during the recruitment process, please let us know.