Security Operations Analyst

The role

You will review and investigate security alerts, logs and incident tickets to protect Zopa's banking services, systems and customers. You will work with a team that also owns security tools and services, including vulnerability management and cloud security, and collaborate with engineering, IT, fraud and customer-facing teams.

What you will do

• Review, triage and investigate security alerts, events and incident tickets.
• Analyse security logs to identify suspicious activity, assess impact and decide next steps.
• Investigate common threats including phishing, malware and account compromise.
• Follow incident response playbooks, escalating incidents and requesting support when needed.
• Maintain accurate investigation notes, ticket updates and incident documentation.
• Work within defined response and resolution expectations for security tickets.
• Collaborate with IT Services, Identity and Access Management, engineering, fraud and customer service teams.
• Develop experience with Splunk, SentinelOne, Netskope and AWS security services.
• Take part in peer reviews and incident retrospectives.
• Support improvements to security processes.

Required qualifications

• Practical experience in security operations or a relevant technical environment such as infrastructure, network, cloud operations or IT support.
• Understanding of cyber security fundamentals, including phishing, malware, account compromise, vulnerabilities, threats and risks.
• Experience reviewing and investigating security alerts or analysing logs.
• Knowledge of the incident response lifecycle and ability to follow documented procedures.
• Foundational knowledge of Windows, macOS, Linux and core networking concepts.
• Understanding of basic cloud concepts, particularly AWS services such as IAM, S3 and CloudTrail.
• Analytical approach to investigations.
• Clear communication, accurate documentation and knowing when to escalate.
• Ability to prioritise security tickets, manage time and work within agreed service levels.
• Curiosity, willingness to learn, and a collaborative approach.

Nice to have

• Experience using SIEM, EDR or security tools such as Splunk, SentinelOne, Netskope, Mimecast, Tenable or AWS GuardDuty.
• Basic scripting experience using Python, Bash or PowerShell.
• Practical experience with phishing investigations or vulnerability management.
• Familiarity with the MITRE ATT&CK framework.
• Experience using Git or version control alongside engineering teams.
• Experience working in financial services, fintech or another regulated environment.
• Awareness of FCA requirements and UK GDPR.
• Security certifications such as CompTIA Security+, CySA+ or CEH, or a relevant degree.
• Experience safely using AI tools to support everyday work.

Benefits

• Flexible ways of working, including hybrid working.
• Option to work from abroad for up to 120 days a year, subject to right to work.
• Support for work and home life from day one.

Before you apply

• Working from abroad is subject to having the right to work in the country of choice.
• Behavioural and competency-based interviews: AI use is not permitted.
• Technical interviews: AI use depends on the stage; the Talent Partner will confirm what is expected.

About the company

Zopa started in 2005 as a peer-to-peer lending company and launched Zopa Bank in 2020. The company says it is named in the top three UK's Most Loved Workplaces.