Senior Information Security Analyst – SOC

About the role

The Senior Information Security Analyst joins Norton Rose Fulbright’s global Security Operations Center (SOC). In this senior position you will provide technical leadership for day‑to‑day monitoring, detection and response activities, while hunting emerging adversary behavior and continuously improving the firm’s threat detection capabilities.

Key responsibilities

• Operate and manage security incidents and service requests, adhering to SLA guidelines and acting as an escalation point for complex investigations.
• Monitor, triage and investigate alerts across endpoints, cloud, identity, email and network telemetry, escalating unusual activity as needed.
• Lead structured incident response following a recognized lifecycle, including containment, eradication, recovery, evidence preservation and digital forensic analysis.
• Remediate phishing, vishing and impersonation attacks promptly based on risk assessment.
• Configure and tune security monitoring parameters, serving as a technical escalation point for alerts.
• Conduct hypothesis‑driven threat hunting on a scheduled basis to uncover adversary activity not detected by existing rules.
• Design, test, tune and maintain detection rules and use cases (e.g., Sigma, KQL) and map coverage to the MITRE ATT&CK framework.
• Develop and maintain SOAR playbooks and automation scripts to streamline response and reduce manual effort.

Required profile

• Several years of experience in a Security Operations Center or similar environment.
• Strong analytical and problem‑solving abilities with a focus on rapid incident resolution.
• Familiarity with the legal sector’s threat landscape and regulatory considerations.
• Ability to work collaboratively in a global, cross‑functional team.

Required skills

• Proficiency with Sigma and KQL query languages for detection rule creation.
• Deep knowledge of the MITRE ATT&CK framework for mapping threats.
• Hands‑on experience with SOAR platforms and security automation.
• Expertise in threat hunting methodologies and incident response lifecycle.
• Practical skills in digital forensics and evidence preservation.
• Experience handling phishing, vishing and impersonation attack remediation.