Cybersecurity Analyst II

Avnet

15d

About The Position

The Security Analyst II investigates and responds to complex, escalated, or high-impact cybersecurity events within a 24/7 Security Operations Centre (SOC). The role analyzes activity across multiple technology domains, correlates evidence, determines incident scope and potential impact, and supports response and remediation. The analyst manages investigations and serves as an on-shift technical escalation point for Security Analyst I, providing guidance on complex cases and supporting timely decisions. Investigations may involve phishing, account compromise, malware, and potential data exposure, and must be documented, progressed, and handed over between shifts. Candidates should be comfortable working rotational shifts, including nights, weekends, and public holidays. The role includes monitoring and investigating security alerts, leading the response to higher-impact incidents, recommending containment and remediation, coordinating with incident response and other internal teams, and supporting junior analysts. It also involves structured shift handovers, maintaining case ownership, contributing to security documentation and process improvements, and staying current with emerging threats and industry practices.

Requirements

At least 3 years of relevant experience in security operations, incident response, threat detection, or a comparable cybersecurity function.
Demonstrated experience independently investigating security incidents, handling escalations, and supporting incident response activities.
Strong understanding of cybersecurity principles, security monitoring, incident response, and security operations processes.
Strong understanding of common cybersecurity threats, vulnerabilities, attack techniques, and adversary behavior, with the ability to apply this knowledge during investigations.
Proficiency in security monitoring and investigation techniques, including independently analyzing alerts, correlating evidence, and determining appropriate response or escalation actions.
Excellent analytical and problem-solving abilities.
Strong written and verbal communication skills in English, including the ability to clearly communicate findings, risks, status, and actions to technical and non-technical stakeholders.
Experience working within globally distributed teams and collaborating across cultures, regions, functions, and time zones.
A collaborative, team-oriented approach and ability to work with Security, Engineering, Product, Infrastructure, GRC, Privacy, Legal, and other business stakeholders.
Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or a related field, or equivalent practical experience demonstrating comparable knowledge and job skills.

Nice To Haves

Prior experience working in a 24x7 or shift-based Security Operations Centre environment is strongly preferred.
Equivalent practical experience may be considered where the required technical and investigative capability is clearly demonstrated.
Intermediate-level cybersecurity certifications such as AZ-500, CySA+, GSOC, or GCIA.
Experience with proactive threat hunting or advanced threat analysis.
Previous experience acting as an Incident Coordinator, Incident Commander, or security incident lead.
Familiarity with scripting or automation for security analysis and operational efficiency.
Experience contributing to post-incident reviews, root-cause analysis, or lessons-learned activities.
Familiarity with phishing investigation and advanced threat intelligence analysis.
Experience contributing to security playbooks, procedures, or process-improvement initiatives.

Responsibilities

Respond to security events in a 24x7 Global Security Operations Centre and maintain visibility across the active alert queue.
Lead investigations and response for higher-impact or complex security incidents; assess scope, severity, and potential business impact.
Recommend and coordinate containment, remediation, and escalation actions in accordance with established procedures.
Collaborate with incident response and relevant internal teams to support effective incident handling.
Investigate and analyze alerts generated by EDR, NDR, and SIEM tools to identify potential incidents.
Correlate evidence, develop investigation hypotheses, construct timelines, and identify potentially affected users or systems.
Document investigation findings and provide detailed reports.
Serve as an on-shift technical escalation point for junior analysts; review escalated investigations and guide additional investigative steps.
Communicate technical findings, security risks, and required actions to relevant stakeholders.
Support coordination of evidence gathering, containment, remediation, and recovery activities.
Provide structured handovers between SOC shifts, review cases transferred from previous shifts, and maintain investigation ownership until resolution, escalation, or formal handover.
Contribute to the development and maintenance of security documentation, procedures, playbooks, and incident response plans.
Identify recurring false positives, detection gaps, and operational inefficiencies, and recommend process improvements.
Stay current with emerging threats, vulnerabilities, and industry best practices, and participate in training and development programmes.