Cybersecurity Analyst

Trupanion

1d•Remote

About The Position

The Cybersecurity Analyst supports day-to-day Security Operations and Incident Response by monitoring and investigating threats, coordinating incident response, conducting threat intelligence and threat hunting, managing operational vulnerability workflows, and maintaining accurate cases and security metrics. Security Engineering owns security-platform engineering and vulnerability-scanning platforms, while technology and application owners execute remediation. This is a remote position open to candidates anywhere in the United Kingdom. Candidates based in the greater Altrincham area will work a hybrid remote/in-office schedule from the company’s casual, pet-friendly office at least three days a week. The role requires support for defined US business-hour coverage, participation in an escalation or on-call rotation, and assistance with high-severity incidents outside normal working hours when required. The base salary range is £50,000–£60,000 on a full-time schedule, with monthly bonus eligibility and Restricted Stock Units for new team members that vest over four years.

Requirements

Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, Digital Forensics, or a related field, or equivalent practical experience.
Experience and expertise in cybersecurity operations, incident response, IT operations, system administration, network security, or a related area.
Experience investigating alerts using SIEM, EDR/XDR, identity, email, cloud, network, or vulnerability technologies.
Knowledge of common attacker techniques, phishing, malware, account compromise, privilege misuse, lateral movement, exfiltration, and vulnerability exploitation.
Demonstrated experience applying threat intelligence and incident telemetry to vulnerability prioritization and exploitation assessment.
Experience with security automation or scripting, digital-evidence handling, identity investigations, third-party incident analysis, and structured case management.
Ability to support defined US business-hour coverage and participate in an escalation or on-call rotation.
Availability to assist with high-severity incidents outside normal working hours when required.
Ability to handle confidential, legally sensitive, and security-restricted information appropriately.

Nice To Haves

Experience with Microsoft Defender, Microsoft Sentinel, Microsoft 365, Azure, identity security, privileged access management, cloud security, and endpoint environments.
Familiarity with MITRE ATT&CK and common detection, threat-hunting, and incident-response methodologies.
Understanding of vulnerability scanning and remediation workflows and the division of responsibility between vulnerability-program governance, threat-led escalation, and asset-owner remediation.
Knowledge of NIST CSF, ISO 27001, PCI DSS, NYDFS cybersecurity requirements, or privacy and breach-response obligations.
Relevant certification such as Security+, CySA+, SC-200, GCIH, GCIA, or equivalent experience.

Responsibilities

Monitor and triage alerts across identity, endpoint, email, network, cloud, application, vulnerability, and data-protection technologies.
Validate, enrich, classify, and prioritize security events; investigate phishing, account compromise, malware, ransomware, unauthorized access, data exposure, insider threats, and third-party events.
Execute approved containment actions within assigned permissions and coordinate infrastructure-level or production changes with Technology Operations.
Collect and preserve evidence; identify affected users, devices, accounts, systems, repositories, and data; and support eradication, recovery validation, heightened monitoring, and incident closure.
Collect and evaluate threat intelligence from commercial, government, industry, open-source, MDR, vendor, and internal sources.
Analyze threat actors, campaigns, tactics, techniques, procedures, indicators, exploited vulnerabilities, and targeted technologies for relevance to Trupanion.
Create tactical and operational intelligence products and operationalize findings through investigations, detections, hunting queries, watchlists, blocking actions, phishing simulation scenarios, and runbook updates.
Conduct hypothesis-driven hunts across identity, endpoint, email, network, cloud, and application telemetry using MITRE ATT&CK, documenting scope, queries, evidence, findings, and follow-up actions.
Validate vulnerability findings, assess risk and business exposure, prioritize remediation using threat intelligence and incident telemetry, identify indications of exploitation, and escalate urgent vulnerabilities.
Hunt for threats affecting vulnerable technologies and recommend temporary containment or monitoring when active exploitation or incident correlation is identified.
Partner with Security Engineering, which owns vulnerability-scanning platforms, integrations, technical configuration, and platform reliability.
Coordinate remediation assignments with technology and application owners; maintain vulnerability ticket flow; track progress against defined service levels; report overdue exposure; and escalate ownership or delivery issues through established governance processes.
Maintain operational oversight of vulnerability validation, prioritization, ticketing, remediation follow-up, SLA reporting, and escalation; remediation execution remains with the responsible technology or application owner.
Develop and maintain approved automation workflows, scripts, and playbooks for alert enrichment, investigation, authorized response, and case consistency.
Preserve identity, endpoint, email, cloud, network, application, and audit-log evidence under approved forensic, legal-hold, integrity, and chain-of-custody procedures.
Maintain complete case records covering severity, affected assets, evidence, analysis, actions, decisions, communications, and closure rationale.
Validate incident containment and corrective actions through available telemetry, testing, or monitoring.
Support breach investigations by identifying affected repositories, records, data types, individuals, business entities, and jurisdictions for Legal and Privacy review.
Investigate token theft, MFA changes, privilege escalation, malicious application consent, mailbox manipulation, and compromised user, privileged, service-principal, or workload identities.
Investigate third-party, supply-chain, and AI-related security notifications or suspected misuse and document potential Trupanion exposure.
Execute alert triage, investigations, MDR service monitoring, threat-intelligence analysis, threat hunting, vulnerability validation and prioritization, remediation follow-up, security metrics and reporting, case documentation, and authorized security-tool actions.
Escalate architecture, complex integration, detection-platform design, routine vulnerability-management administration, and permanent engineering needs to Security Engineering.
Provide structured handovers of active alerts, incidents, intelligence, investigations, and urgent exploitation-driven vulnerability exposures across operating regions.
Provide technical evidence to Legal and Privacy without independently determining legal privilege, regulatory interpretation, or notification obligations.
Support defined US business-hour coverage, participate in an escalation or on-call rotation, and assist with high-severity incidents outside normal working hours when required.

Benefits

Monthly bonus opportunities
Restricted Stock Units for new team members, vesting over four years
Private medical insurance and health cash plans
33 days annual leave including bank holidays
Five-week sabbatical after five years of employment
Open, casual, and fun office environment
Cycle to work scheme
Life Insurance, Critical Illness Cover and Group Income Protection
Lifestyle Spending Account
Employee Assistance Programmes including Mental Health Support, Medical Referrals, Legal and Financial Support, and perks