Senior SOC Analyst

About Us

We are part of International Airlines Group (IAG), one of the world’s leading airline groups and owner of some of the biggest brands in the sky.

IAG Transform provides creative and innovative solutions to drive sustainable transformation by delivering procurement and airline services, as well as group-wide systems across IAG. Each operating company benefits from the Transform centralised model, driving efficiencies, automation, and economies of scale.

The Senior SOC Analyst is a senior member of the IAG Cyber Defence Centre. The role identifies, investigates and responds to emerging and ongoing threats across IAG networks, systems, users and applications. It acts as the primary escalation point for critical security alerts, leads proactive threat hunting, and works with technical and non-technical teams, up to security leadership, to make sure risks are mitigated quickly. The role also mentors and guides less experienced analysts.

The Senior SOC Analyst uses a wide range of tools and resources to identify, investigate and respond to threats affecting IAG networks, systems, users and applications. The role works closely with technical and non-technical teams, including security leadership and business representatives, and drives the relevant teams to take the right actions in the right time frames to mitigate risk. It includes a rotating on-call schedule and may require work outside normal hours for critical incidents.

Your responsibilities

• Act as the primary escalation point for critical security alerts, analysing them and building the full attack chain across cloud, identity, email, network and endpoint.
• Lead investigation and response to security incidents, driving the relevant teams to contain and remediate within the required time frames.
• Turn threat intelligence into proactive threat hunting, and research new and emerging attacks, threat actors, malware and TTPs.
• Produce and interpret security metrics, and present findings clearly at all levels, up to senior leadership.
• Mentor and guide less experienced analysts.
• Take part in the rotating on-call schedule and respond to critical incidents outside normal hours when required.

• Security analysis and incident investigation across cloud, identity, email, network and endpoint
• Investigation of Windows and Linux systems using EDR/XDR tooling such as CrowdStrike and Microsoft Defender
• AWS log monitoring, including GuardDuty, CloudTrail and VPC Flow
• Memory forensics, including dump extraction and analysis
• Threat hunting and TTP research
• Strong understanding of the cyber threat landscape, particularly in aviation
• Malware analysis and reverse engineering
• Penetration testing
• Digital forensics

What we offer