Senior Security Assistant

Role Purpose & Context

Role Summary

The Senior Security Assistant is here to really get stuck into our security alerts and incidents. You'll move past just escalating things and start figuring out what's actually going on, helping to contain issues and improve how we do things. This role directly impacts our ability to spot and stop threats, keeping our systems and data safe from the bad guys. Day-to-day, you'll be at the sharp end of our security operations, analysing suspicious activity and helping to refine our incident response plans. You're the bridge between the raw alerts and the tactical decisions our Security Lead makes. When you do this well, we catch things faster, reduce our exposure, and learn from every incident. If it's not done properly, we miss critical threats, systems get compromised, and our reputation takes a hit. The tricky part is sifting through a mountain of noise to find the one signal that matters, often with incomplete information. The reward, though, is knowing you've genuinely protected the company and helped build a more robust defence.

Reporting Structure

• Reports to: Security Operations Lead
• Direct reports: Typically 0, but you'll mentor 1-2 junior team members informally.
• Matrix relationships: Security Analyst I, Senior Security Operations Specialist, Information Security Associate (Senior),

Key Stakeholders

Internal:

• Security Operations Lead
• IT Infrastructure Team
• Network Operations Team
• Product Development Teams
• Internal Audit & Compliance

External:

• Security Vendors (e.g., SIEM, EDR providers)
• External Security Auditors
• Threat Intelligence Feeds

Organisational Impact

Scope: Your work ensures that our immediate security posture is strong, reducing the attack surface and improving our response times to actual threats. You directly contribute to the resilience of our technical infrastructure and the protection of sensitive company data, which, frankly, is pretty crucial for keeping the lights on and avoiding massive fines.

Performance Metrics

Quantitative Metrics

1. Metric: Mean Time to Investigate (MTTI) Critical Alerts
2. Desc: How quickly you start a deep dive into high-priority security alerts after they're identified.
3. Target: < 30 minutes
4. Freq: Weekly review of incident logs
5. Example: An EDR alert fires for a potential ransomware attack at 09:00. You've started your investigation, pulled logs, and updated the incident ticket by 09:25, beating the target.
6. Metric: False Positive Reduction from Rule Tuning
7. Desc: The percentage decrease in benign alerts after you've refined SIEM or EDR detection rules.
8. Target: Reduce by 15% per quarter for assigned rules
9. Freq: Quarterly review of alert volumes and incident closures
10. Example: You take ownership of the 'suspicious login from new geo' rule. After your tuning, the daily false positives drop from 50 to 40, a 20% reduction, meaning the team has less noise to sift through.
11. Metric: Vulnerability Remediation Tracking Efficiency
12. Desc: The percentage of critical and high vulnerability tickets you're tracking that are closed within their agreed SLAs.
13. Target: 90% of critical/high vulnerabilities closed on time
14. Freq: Monthly report from vulnerability management platform
15. Example: Out of 10 critical vulnerabilities assigned to various teams, 9 are patched or mitigated by their due dates, thanks to your diligent follow-ups and clear communication.
16. Metric: Phishing Triage & Analysis Accuracy
17. Desc: How accurately you classify user-reported phishing emails (e.g., legitimate, spam, actual threat) and identify Indicators of Compromise (IOCs).
18. Target: 99% accuracy in classification and IOC extraction
19. Freq: Weekly spot-check by Security Lead
20. Example: You analyse 100 phishing emails; 99 are correctly categorised, and all relevant malicious URLs or file hashes are extracted and added to our block lists.

Qualitative Metrics

1. Metric: Documentation Quality & Improvement
2. Desc: Your contribution to creating and improving our security runbooks, playbooks, and knowledge base articles. This isn't just updating; it's making them genuinely better and easier to follow.
3. Evidence: Regular contributions to the Confluence security space; positive feedback from junior team members using your documentation; clear, concise, and accurate new runbooks for common incidents; proactive identification of documentation gaps.
4. Metric: Proactive Threat Hunting & Anomaly Detection
5. Desc: Your initiative in looking for suspicious activity that hasn't triggered an alert yet, or digging deeper into low-priority alerts that others might dismiss.
6. Evidence: You present findings from a self-initiated SIEM query that uncovered a previously unknown suspicious internal connection; you identify a new phishing campaign variant before it's widely reported; you suggest new detection rules based on observed attacker TTPs (Tactics, Techniques, and Procedures).
7. Metric: Collaboration & Knowledge Sharing
8. Desc: How effectively you work with other teams (IT, Network, Development) and share your security knowledge within the team, especially with junior colleagues.
9. Evidence: Other teams actively seek your input on security-related changes; you lead internal knowledge-sharing sessions or workshops; junior analysts frequently come to you for advice and praise your mentorship; you contribute actively to team discussions and post-incident reviews.
10. Metric: Process Improvement & Automation Suggestions
11. Desc: Your ability to spot inefficiencies in our security operations and propose practical solutions, potentially involving automation or new tools.
12. Evidence: You propose a script to automate a repetitive log analysis task, saving 2 hours a week; you suggest a change to our access review process that makes it more robust and less manual; your ideas are often discussed and sometimes implemented by the team or lead.

Primary Traits

• Trait: Meticulous Investigator
• Manifestation: You don't just see an alert; you see a puzzle. You'll follow every breadcrumb, no matter how small, to understand the full picture of a potential incident. You'll spot the one character difference in a suspicious domain name that others miss, or notice that a user's login time is unusual by just a few minutes. When you're told 'it's probably nothing,' you're the one who still checks, just in case.
• Benefit: In security, the devil is always in the details. A single missed log entry, a slightly off timestamp, or a misidentified IP address can mean the difference between catching a breach early and dealing with a full-blown crisis. We need someone who genuinely enjoys the hunt and has an almost obsessive need to get to the bottom of things, because that's what protects us.
• Trait: Process Improver
• Manifestation: You're great at following the rules, but you're even better at spotting where the rules could be improved. You'll complete a runbook task, then immediately think, 'There's a faster, more robust way to do this.' You'll suggest tweaks to our alert correlation rules or propose a new step in our phishing triage process that makes it more efficient. You don't just do the job; you make the job better.
• Benefit: Our security landscape changes constantly, and so must our processes. Sticking rigidly to outdated methods leaves us vulnerable. We need someone who can both execute flawlessly *and* critically evaluate our operations, bringing fresh ideas to the table. Your ability to refine our playbooks means we're always getting smarter and faster at defence.
• Trait: Calm and Clear Communicator
• Manifestation: When a critical alert fires and everyone else is panicking, you're the one calmly opening the playbook, methodically working through the steps, and updating the incident ticket with clear, concise notes. You can explain a complex technical issue to a non-technical manager without jargon, and you can handle a frantic, locked-out executive with professional courtesy and a steady hand. You know when to escalate and how to do it effectively.
• Benefit: Security incidents are stressful. Your ability to remain composed under pressure prevents mistakes and helps the whole team stay focused. Clear communication, especially during a crisis, is absolutely vital for coordinating our response, keeping stakeholders informed, and ensuring everyone knows what's happening without adding to the chaos. You're a stabilising force.

Supporting Traits

• Trait: Naturally Curious
• Desc: You're not content with just knowing 'what' to do; you want to understand 'why' a security control exists or 'how' an attack actually works. This curiosity drives you to learn more and anticipate future threats.
• Trait: Discreet and Trustworthy
• Desc: You'll be privy to highly sensitive information about incidents, vulnerabilities, and even personnel. You understand that confidentiality is paramount and that discretion is non-negotiable.
• Trait: Proactive Problem Solver
• Desc: You don't wait for problems to land on your desk. You're always looking for potential issues, whether it's a gap in our monitoring or a recurring false positive, and you're ready to suggest solutions.
• Trait: Resilient
• Desc: Security work can be relentless. You can handle the occasional late night during an incident, the frustration of chasing teams for remediation, and the constant barrage of alerts without burning out.

Primary Motivators

1. Motivator: Solving Complex Puzzles
2. Daily: You'll spend hours digging through logs and correlating events to piece together what happened during a suspicious activity alert. It's like being a detective, but for digital crimes.
3. Motivator: Making a Tangible Impact
4. Daily: Your work directly contributes to stopping real threats. When you successfully identify and help contain a phishing campaign, you're protecting our colleagues and the company's data.
5. Motivator: Continuous Learning and Improvement
6. Daily: The threat landscape changes daily. You'll be constantly learning about new attack techniques and defence strategies, and then applying that knowledge to improve our own security posture.

Potential Demotivators

Honestly, this role isn't for everyone. You'll spend a fair bit of time chasing other teams to patch vulnerabilities you've highlighted, and sometimes it feels like pulling teeth. You'll also deal with a lot of 'noise' – false positive alerts that you have to investigate, only to find nothing. The 'urgent' request that disrupted your Tuesday might get deprioritised by Friday because something else blew up. If you need every piece of your work to go smoothly and see immediate, perfect resolution, you might struggle here. The reality is messier than the textbooks suggest, and sometimes, you're a necessary blocker, not a hero.

Common Frustrations

1. Chasing other teams for weeks to get critical vulnerabilities patched, only for them to miss the deadline.
2. Investigating hundreds of low-priority alerts only to find they're all false positives, leading to genuine 'alert fatigue'.
3. Users still clicking on obvious phishing links, despite all the training, meaning you have to clean up the mess.
4. Being seen as a 'blocker' by development teams who just want to ship code fast, without fully understanding the security implications.
5. The sheer volume of documentation updates and knowledge base maintenance – it's crucial but rarely exciting.

What Role Doesn't Offer

1. A quiet, predictable 9-to-5 job with no surprises.
2. Constant praise and recognition for every task – much of your work is preventative and goes unnoticed until it's needed.
3. An environment where every problem has a clear, easy solution and all data is perfectly clean.
4. A role where you're always building new, shiny things; often, it's about maintaining, improving, and defending existing systems.

ADHD Positives

1. The fast-paced, investigative nature of incident response can be highly engaging for those with ADHD, offering varied tasks and high-stakes problem-solving that can tap into hyperfocus.
2. The constant influx of new alerts and challenges means less routine, which can be a positive. Each incident is a new puzzle to solve.
3. The need for quick, decisive action during containment phases can suit individuals who thrive under pressure and can think on their feet.

ADHD Challenges and Accommodations

1. The volume of alerts and the need for meticulous documentation can be challenging. We can offer tools for structured note-taking and templates to guide documentation.
2. Maintaining focus during long periods of sifting through logs for subtle anomalies might require scheduled breaks or pairing with a colleague.
3. Prioritisation can be tricky when multiple 'urgent' things come in. We use clear ticketing systems and daily stand-ups to help manage priorities and provide support.

Dyslexia Positives

1. Strong spatial reasoning and pattern recognition, common strengths in dyslexia, are incredibly valuable for spotting anomalies in logs or network traffic patterns.
2. The ability to think holistically about systems and connections can help in understanding complex attack chains, even if individual details are harder to process.
3. Often excellent verbal communicators, which is crucial for explaining complex security issues to various teams.

Dyslexia Challenges and Accommodations

1. Extensive reading of technical documentation, logs, and incident reports can be demanding. We encourage the use of screen readers, text-to-speech software, and provide documentation in accessible formats.
2. Writing clear, concise incident reports is essential. We can offer templates, grammar-checking tools, and peer review support to ensure accuracy without adding undue stress.
3. Attention to detail in spelling (e.g., in domain names) is critical. Tools like browser extensions for spell-checking and dedicated review time are standard practice.

Autism Positives

1. A strong preference for logical, rule-based systems and processes is a huge asset in security operations, where adherence to runbooks and protocols is key.
2. Exceptional attention to detail and pattern recognition, particularly for spotting anomalies or inconsistencies in data, is highly valued in threat detection and analysis.
3. The ability to focus deeply on specific tasks and technical investigations, without being easily distracted, can lead to thorough and accurate incident analysis.

Autism Challenges and Accommodations

1. Social interactions, especially during high-stress incident calls, can be overwhelming. We aim for clear agendas, defined roles in meetings, and allow for non-verbal communication where possible (e.g., chat for questions).
2. Changes to routine or unexpected 'urgent' tasks can be disruptive. We try to provide as much heads-up as possible and clear communication about shifting priorities.
3. Sensory input in an office environment (noise, light) can be challenging. We offer noise-cancelling headphones, flexible seating options, and quiet zones for focused work.

Key Responsibilities

Experience Levels Responsibilities

1. Level: Senior Security Assistant (L3)
2. Responsibilities: Independently investigate and triage security alerts from our SIEM (Microsoft Sentinel) and EDR (CrowdStrike Falcon) platforms, determining if they're genuine threats or false positives.
3. Lead the analysis of user-reported phishing emails in the 'phish bucket,' identifying malicious indicators (IOCs) and coordinating with the Security Lead on appropriate response actions.
4. Own specific sections of our vulnerability management programme, which means you'll configure and schedule scans (Tenable.io), analyse reports, and then chase down asset owners to make sure they patch things up.
5. Design and implement improvements to existing security runbooks and playbooks, making them clearer, more efficient, and better suited to current threats. You'll actually help write the rules, not just follow them.
6. Mentor 1-2 junior Security Assistants, providing guidance on incident triage, log analysis techniques, and best practices for using our security tools. You'll be the go-to person for their tricky questions.
7. Perform regular user access reviews for critical systems (Azure AD, Okta), making sure everyone still has the 'least privilege' they need and nothing more. You'll spot anomalies and recommend changes.
8. Contribute to post-incident reviews, helping the team understand what went wrong, what went right, and what we can do better next time. This means digging into the 'lessons learned' phase of PICERL.
9. Supervision: You'll have bi-weekly check-ins with the Security Operations Lead, but for day-to-day tasks and routine incident investigations, you're pretty much running your own show. For anything truly novel or high-impact, you'll consult with the Lead before taking action.
10. Decision: You've got full technical decision authority within the scope of an incident investigation (e.g., what logs to pull, which tools to use for analysis). You can recommend changes to security policies or tool configurations, but those will need approval from the Security Operations Lead. You can't approve budget spend over £5K without sign-off.
11. Success: You'll know you're doing well when critical alerts are investigated thoroughly and quickly, your proposed process improvements are adopted by the team, and junior colleagues consistently come to you for advice. Basically, you're making things better and helping others grow.

Decision-Making Authority

• Type: Incident Triage & Initial Containment
• Entry: Escalate all suspicious alerts to a senior team member for review and guidance.
• Mid: Independently triage routine alerts, follow established runbooks for initial containment (e.g., isolating a host) and escalate exceptions.
• Senior: Independently investigate and triage complex or novel alerts, making initial containment decisions based on judgment, and then inform the Security Lead. You'll recommend the full response plan.
• Type: Process & Runbook Changes
• Entry: Suggest minor edits to existing documentation to your supervisor.
• Mid: Propose improvements to existing runbooks for review by a senior team member.
• Senior: Design and draft new runbooks or significantly re-engineer existing processes, presenting them to the Security Lead for final approval and implementation.
• Type: Tool Configuration & Tuning
• Entry: No authority; report observed issues to a senior team member.
• Mid: Suggest changes to SIEM/EDR rules to reduce false positives, requiring approval from a senior team member.
• Senior: Independently tune existing SIEM/EDR detection rules to optimise performance and reduce noise, informing the Security Lead of changes. You'll also recommend new detection rules based on threat intelligence.
• Type: Mentorship & Training
• Entry: Seek guidance from senior team members.
• Mid: Provide informal guidance to new joiners on basic tasks.
• Senior: Actively mentor 1-2 junior Security Assistants, providing structured guidance, code reviews, and knowledge transfer sessions. You're a key part of their development.

Competency Requirements

Foundation Skills (Transferable)

Beyond the technical wizardry, you need a solid foundation of 'human' skills. These are the bedrock that allows you to translate complex security issues into understandable language, work effectively with others, and stay sharp when things get tough. Frankly, these are often harder to teach than the tech skills.

• Category: Communication & Collaboration
• Skills: Clear and concise written communication for incident reports, documentation, and emails (no jargon, please).
• Effective verbal communication for explaining technical issues to non-technical teams and during incident calls.
• Active listening to understand stakeholder concerns and gather accurate information during investigations.
• Ability to work effectively within a team, sharing knowledge and supporting colleagues during high-pressure situations.
• Category: Problem Solving & Critical Thinking
• Skills: Analytical thinking to break down complex security incidents into manageable parts and identify root causes.
• Critical evaluation of information from various sources (logs, alerts, threat intel) to form a coherent picture.
• Troubleshooting skills to diagnose and resolve security-related issues in systems and applications.
• Ability to think proactively about potential threats and vulnerabilities, not just react to alerts.
• Category: Adaptability & Resilience
• Skills: Comfort with ambiguity; security incidents rarely have all the answers upfront, and you'll need to work with incomplete data.
• Ability to adapt quickly to new threats, technologies, and shifting priorities (because, let's be honest, they shift a lot).
• Emotional resilience to handle the pressure of incidents and the frustration of repetitive tasks or uncooperative teams.
• Continuous learning mindset to stay current with the rapidly evolving cybersecurity landscape.
• Category: Attention to Detail & Organisation
• Skills: Meticulous attention to detail when analysing logs, configuring rules, or reviewing access permissions.
• Strong organisational skills to manage multiple investigations, vulnerability remediation efforts, and documentation tasks simultaneously.
• Systematic approach to following procedures and checklists, ensuring consistency and auditability.
• Time management to prioritise tasks effectively and meet deadlines, especially during incidents.

Functional Skills (Role-Specific Technical)

This is where the rubber meets the road. You'll need a solid grasp of core security concepts and the tools we use every day. We're looking for someone who can move beyond basic operation and start to really dig into the 'how' and 'why' of our security posture.

Technical Competencies

• Skill: Incident Response Lifecycle (PICERL)
• Desc: A deep understanding of all phases: Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learned. You'll not just execute steps but understand the purpose of each, helping to refine our response plans.
• Level: Advanced
• Skill: Access Control Principles
• Desc: You don't just provision users; you understand Least Privilege, Separation of Duties, and Role-Based Access Control (RBAC) inside out. This guides every access decision and review you make.
• Level: Advanced
• Skill: Vulnerability Management Process
• Desc: You know the full cycle: asset discovery, scanning, prioritisation (using CVSS scores and business context), remediation ticket-tracking, and validation scanning. You'll be able to manage this end-to-end for specific asset groups.
• Level: Advanced
• Skill: Phishing Triage & Analysis
• Desc: The methodical process of analysing user-reported emails, identifying malicious indicators (suspicious headers, URLs, attachments), and safely using sandboxing tools. You'll be able to identify sophisticated campaigns.
• Level: Advanced
• Skill: Security Metrics & Reporting
• Desc: Understanding how to gather raw data (e.g., number of open vulnerabilities, phishing click rates) and present it clearly to demonstrate the security team's performance and risk posture. You'll contribute to quarterly reports.
• Level: Intermediate
• Skill: Basic Scripting (Python/PowerShell)
• Desc: You should be able to read and understand basic scripts, and ideally, write simple scripts to automate repetitive tasks or parse logs. This isn't a developer role, but automation is key for efficiency.
• Level: Intermediate

Digital Tools

• Tool: Microsoft Sentinel / Splunk (or similar SIEM)
• Level: Advanced
• Usage: Running complex KQL/SPL queries to investigate alerts, building custom dashboards for specific threat hunting scenarios, and tuning detection rules to reduce false positives.
• Tool: CrowdStrike Falcon / SentinelOne (or similar EDR)
• Level: Advanced
• Usage: Investigating advanced EDR alerts, isolating compromised hosts, deploying agents to new endpoints, and developing endpoint security policies.
• Tool: Tenable.io / Qualys VMDR (or similar VM platform)
• Level: Advanced
• Usage: Configuring and scheduling vulnerability scans, generating custom reports for various teams, and validating remediation efforts.
• Tool: Azure Active Directory / Okta (or similar IAM)
• Level: Advanced
• Usage: Managing access roles and group policies, conducting regular user access reviews, and troubleshooting complex access issues.
• Tool: ServiceNow / Jira (for security workflows)
• Level: Advanced
• Usage: Configuring custom dashboards, helping refine security incident and request workflows, and acting as a queue manager for specific workstreams.
• Tool: Confluence / Notion (for knowledge management)
• Level: Advanced
• Usage: Owning and maintaining specific sections of the security knowledge base, creating new documentation for processes you manage, and organising the team's space for optimal information retrieval.

Industry Knowledge

• Area: Common Attack Vectors & TTPs
• Desc: A solid understanding of how attackers compromise systems (e.g., phishing, malware, brute force, supply chain attacks) and their typical tactics, techniques, and procedures.
• Area: Cloud Security Fundamentals (Azure/AWS)
• Desc: Basic knowledge of cloud security concepts, common misconfigurations in Azure or AWS, and how to interpret cloud security logs.
• Area: Network Security Basics
• Desc: Understanding of firewalls, IDS/IPS, VPNs, and common network protocols (TCP/IP, DNS, HTTP) to assist in network-related investigations.

Regulatory Compliance Regulations

• Reg: GDPR (General Data Protection Regulation)
• Usage: Understanding how security incidents impact personal data, the requirements for breach notification, and the importance of data minimisation and access control in protecting personal information.
• Reg: ISO 27001 (Information Security Management)
• Usage: Familiarity with the principles of an Information Security Management System (ISMS), understanding how your daily tasks contribute to our compliance, and participating in internal audits.
• Reg: NIS Regulations (Network and Information Systems)
• Usage: Awareness of the importance of maintaining the security of essential services and digital service providers, and how incident reporting contributes to this framework.

Essential Prerequisites

• At least 4-5 years of hands-on experience in a security operations centre (SOC) or a similar technical security role, where you were actively involved in incident triage and response.
• Proven ability to analyse security alerts from SIEM/EDR platforms and distinguish between genuine threats and false positives.
• Demonstrable experience with at least two of the core security tools mentioned (e.g., a SIEM and an EDR, or a VM platform and an IAM solution).
• A solid understanding of networking fundamentals (TCP/IP, DNS) and operating systems (Windows, Linux) from a security perspective.
• Experience in documenting security processes, incident timelines, and technical findings clearly and concisely.
• A track record of taking initiative to improve processes or learn new security concepts.

Career Pathway Context

Think of these as the building blocks you should already have in place. You've been doing the basics for a while, and now you're ready to step up and take on more complex challenges. You're not just following instructions; you're starting to understand the 'why' and contributing to the 'how'.

Qualifications & Credentials

Emerging Foundation Skills

• Skill: Prompt Engineering & LLM Integration for Security
• Why: AI assistants are already here, and they're getting smarter. Competitors are using tools like ChatGPT and Claude to draft incident reports, summarise threat intel, and even suggest detection rules in minutes. Analysts who master this will outproduce peers significantly.
• Concepts: [{'concept_name': 'Context windows and token limits', 'description': 'Understanding how much information an LLM can process at once and how to optimise prompts for large datasets.'}, {'concept_name': 'Temperature settings for different tasks', 'description': 'Knowing when to ask for creative, exploratory responses versus precise, factual summaries for security tasks.'}, {'concept_name': 'RAG (Retrieval Augmented Generation) architectures', 'description': 'How to connect LLMs to our internal, proprietary security knowledge bases and logs for more accurate, context-specific responses.'}, {'concept_name': 'Output validation and hallucination detection', 'description': "Critically assessing AI-generated content for accuracy and identifying when an LLM has 'made things up' – crucial in security."}, {'concept_name': 'Prompt chaining for complex analysis', 'description': 'Breaking down a complex security analysis task into multiple, sequential prompts to get a more detailed and accurate output.'}]
• Prepare: This week: Set up and start using GitHub Copilot or a similar AI coding assistant for any scripting tasks.
• This month: Experiment with ChatGPT/Claude to summarise 3-5 threat intelligence reports or draft sections of an incident report.
• Month 2: Research and prototype a simple RAG setup using an open-source LLM and a small internal security document (e.g., a runbook).
• Month 3: Share your findings and any productivity gains with the team, identifying potential areas for wider adoption.
• QuickWin: Start using AI to draft email summaries, generate code comments, or brainstorm detection rule ideas today. No approval needed, immediate benefit.
• Skill: Cloud-Native Security (Advanced Azure/AWS)
• Why: Our infrastructure is increasingly moving to the cloud. Understanding how to secure cloud environments isn't just a 'nice-to-have' anymore; it's fundamental. Attackers are constantly finding new ways to exploit cloud misconfigurations.
• Concepts: [{'concept_name': 'Cloud Identity and Access Management (IAM)', 'description': 'Deep dive into Azure AD roles, conditional access, and privileged identity management, or AWS IAM roles, policies, and federated access.'}, {'concept_name': 'Cloud Security Posture Management (CSPM)', 'description': 'Understanding tools and techniques to continuously monitor cloud environments for misconfigurations and compliance violations.'}, {'concept_name': 'Container Security (Docker/Kubernetes)', 'description': 'Basic understanding of containerisation, common vulnerabilities in container images, and runtime protection strategies.'}, {'concept_name': 'Serverless Security (Functions/Lambdas)', 'description': 'Security considerations for serverless architectures, including input validation, least privilege, and logging.'}, {'concept_name': 'Cloud Logging & Monitoring', 'description': 'How to effectively collect, analyse, and alert on security events from various cloud services (e.g., Azure Monitor, AWS CloudWatch/CloudTrail).'}]
• Prepare: This week: Complete a free online course on Azure Security Fundamentals (AZ-900) or AWS Cloud Practitioner (CLF-C01).
• This month: Get hands-on with a personal Azure/AWS sandbox account, intentionally misconfigure something, and then try to detect it.
• Month 2: Research common cloud attack techniques (e.g., S3 bucket misconfigurations, IAM role assumption) and how to detect them in our SIEM.
• Month 3: Propose a new cloud security detection rule for our Microsoft Sentinel based on your learning.
• QuickWin: Start reviewing existing cloud security documentation and ask the cloud engineering team about their current security concerns.

Advancing Technical Skills

• Skill: Advanced Threat Hunting Techniques
• Why: Automated alerts are great, but the really sophisticated attackers often bypass them. We need people who can proactively search for threats that haven't triggered an alarm yet, using hypotheses and deep data analysis.
• Concepts: [{'concept_name': 'Hypothesis-driven threat hunting', 'description': 'Formulating a theory about attacker activity and then using data to prove or disprove it.'}, {'concept_name': 'Anomaly detection beyond rules', 'description': 'Identifying deviations from normal behaviour using statistical methods or baselining.'}, {'concept_name': 'MITRE ATT&CK Framework application', 'description': 'Using ATT&CK to map attacker techniques, identify detection gaps, and inform hunting efforts.'}, {'concept_name': 'Advanced KQL/SPL for complex queries', 'description': 'Writing highly optimised and complex queries to search large datasets for subtle indicators.'}, {'concept_name': 'Threat intelligence integration', 'description': 'Actively incorporating external threat intelligence into hunting campaigns and detection rule creation.'}]
• Prepare: This week: Pick a recent, publicly disclosed attack and try to replicate its detection using our current SIEM/EDR data.
• This month: Read 'Threat Hunting: Defending the Enterprise with Attack Kill Chain' by Kyle Adams.
• Month 2: Develop and execute one small, hypothesis-driven threat hunt campaign, documenting your steps and findings.
• Month 3: Present your hunting methodology and findings to the wider security team.
• QuickWin: Start by regularly reviewing your SIEM's 'raw' logs for patterns that aren't currently alerting, just to see what you find.
• Skill: Security Orchestration, Automation, and Response (SOAR)
• Why: As alert volumes grow, manual response becomes unsustainable. SOAR platforms automate repetitive tasks, allowing us to respond faster and more consistently to incidents. You'll move from manual execution to designing and building these automated workflows.
• Concepts: [{'concept_name': 'Playbook development', 'description': 'Designing automated workflows for common security incidents (e.g., phishing response, malware containment).'}, {'concept_name': 'Integration with security tools', 'description': 'Connecting SOAR platforms to SIEM, EDR, IAM, and ticketing systems via APIs.'}, {'concept_name': 'Incident enrichment', 'description': 'Automating the collection of additional context (e.g., threat intelligence lookups, user details) for alerts.'}, {'concept_name': 'Workflow logic and decision trees', 'description': "Designing the 'if-then-else' logic that guides automated responses."}, {'concept_name': 'Error handling and resilience', 'description': 'Building robust playbooks that can handle unexpected inputs or failed integrations.'}]
• Prepare: This week: Research common SOAR platforms (e.g., Splunk SOAR, Microsoft Sentinel Playbooks/Logic Apps).
• This month: Map out a simple, repetitive security task you do manually and design a theoretical automated workflow for it.
• Month 2: If available, get access to our SOAR platform (or a trial version) and build a basic automated playbook for a low-risk task.
• Month 3: Present your SOAR ideas to the Security Lead, highlighting potential time savings and consistency improvements.
• QuickWin: Start thinking about *every* repetitive task you do and how it *could* be automated – even if it's just a simple script.

Education Requirements

• Level: Minimum
• Req: A degree (Bachelor's or equivalent) in Computer Science, Cybersecurity, Information Technology, or a related technical field.
• Alts: Alternatively, significant demonstrable experience (7+ years) in a dedicated security operations role, coupled with relevant industry certifications, will be considered. We're more interested in what you can actually do than just a piece of paper.
• Level: Preferred
• Req: A Master's degree in Cybersecurity or a related field.
• Alts: Not essential, but it shows a deeper academic grounding. Practical experience often trumps advanced degrees in our field, frankly.

Experience Requirements

You'll need roughly 5-8 years of hands-on experience in a dedicated security operations or incident response role. This isn't your first rodeo; you've been in the trenches, investigated real incidents, and you're comfortable with the pace and pressure. We're looking for demonstrable experience in analysing alerts, managing vulnerabilities, and contributing to incident response efforts, not just observing them.

Preferred Certifications

• Cert: CompTIA Security+
• Prod: CompTIA
• Usage: A great foundational certification that proves you understand core security concepts, network security, threats, and vulnerabilities. It's a good baseline.
• Cert: CySA+ (Cybersecurity Analyst+)
• Prod: CompTIA
• Usage: This one is more aligned with the 'analyst' part of your role, focusing on threat detection, analysis, and vulnerability management. It shows you've got the practical skills we need.
• Cert: SC-200 (Microsoft Security Operations Analyst)
• Prod: Microsoft
• Usage: Given our reliance on Microsoft Sentinel and Azure AD, this certification demonstrates your proficiency with our actual tech stack, which is a huge plus.
• Cert: GCIH (GIAC Certified Incident Handler)
• Prod: GIAC
• Usage: This is a gold standard for incident response. It shows you've got serious chops in handling and responding to security incidents, which is a big part of this role's progression.

Recommended Activities

• Regularly participate in cybersecurity webinars, conferences (even virtual ones), and local meetups to stay current with industry trends and network with peers.
• Contribute to open-source security projects or personal labs to get hands-on experience with new tools and techniques.
• Read industry blogs, threat intelligence reports, and security research papers (e.g., from Mandiant, CrowdStrike, Microsoft) to deepen your understanding of the threat landscape.
• Engage in online CTF (Capture The Flag) challenges or hack-the-box exercises to sharpen your analytical and problem-solving skills in a safe environment.

Career Progression Pathways

Entry Paths to This Role

• Path: Mid-Level Security Operations Assistant
• Time: 2-3 years
• Path: IT Support Engineer with Security Focus
• Time: 3-4 years
• Path: Junior Security Analyst (from another company)
• Time: 1-2 years

Career Progression From This Role

• Pathway: Security Analyst II / Lead Security Assistant (L4)
• Time: 3-5 years from L3
• Pathway: Specialist Security Analyst (e.g., Threat Intelligence, IAM, Cloud Security)
• Time: 4-6 years from L3

Long Term Vision Potential Roles

• Title: Principal Security Analyst (L5)
• Time: 7-10 years from L3
• Title: Security Manager / Director (L6)
• Time: 10-15 years from L3
• Title: Security Architect
• Time: 8-12 years from L3

How Zavmo Delivers This Role's Development

DISCOVER Phase: Skills Gap Analysis

Zavmo maps your current competencies against all requirements in this job description through conversational assessment. We evaluate your foundation skills (communication, strategic thinking), functional skills (CRM expertise, negotiation), and readiness for career progression.

Output: Personalised skills gap heat map showing strengths and priorities, estimated time to competency, neurodiversity accommodations.

DISCUSS Phase: Personalised Learning Pathway

Based on your DISCOVER results, Zavmo creates a personalised learning plan prioritised by impact: foundation skills first, then functional skills. We adapt to your learning style, pace, and neurodiversity needs (ADHD, dyslexia, autism).

Output: Week-by-week schedule, each module linked to specific job responsibilities, checkpoints and milestones.

DELIVER Phase: Conversational Learning

Learn through conversation, not boring modules. Zavmo uses 10 conversation types (Socratic dialogue, role-play, coaching, case studies) to build competence. Practice difficult QBR presentations, negotiate tough renewals, and handle churn conversations in a safe AI environment before facing real clients.

Example: "For 'Stakeholder Mapping', Zavmo will guide you through analysing a complex enterprise account, identifying key decision-makers, and building an engagement strategy."

DEMONSTRATE Phase: Competency Assessment

Zavmo automatically builds your evidence portfolio as you learn. Every conversation, practice scenario, and application example is captured and mapped to NOS performance criteria. When ready, your portfolio supports OFQUAL qualification claims and demonstrates competence to employers.

Output: Competency matrix, evidence portfolio (downloadable), qualification readiness, career progression score.