Top Security Analyst Jobs in Glasgow

Detect, analyze, and respond to security incidents in real time across Windows, macOS, and Linux. Perform malware and forensic analysis, remote remediation, develop detection and triage processes, produce customer-facing communications, mentor and quality-assure junior analysts, manage programs/teams, and contribute to public thought leadership.

CrowdStrike seeks a Senior Intelligence Analyst to provide threat intelligence and digital risk monitoring, collaborating with teams to deliver customer-focused solutions and presentations, while maintaining customer relationships.

Triage, investigate, and remediate security alerts using EDR and forensic artifacts. Perform tactical malware analysis, investigate Microsoft M365 activity, assist escalations, contribute to detection engineering, and work on projects to improve SOC outcomes while mentoring and collaborating with teammates.

Execute and manage IT audit activities, assess controls and regulatory compliance (SOX, GDPR, ISO, NIST), run control testing, use GRC tools for evidence tracking, perform IT risk assessments, manage third-party risk, coordinate with auditors and stakeholders, and provide actionable security and compliance insights to leadership.

Lead end-to-end digital forensic investigations for insider risk and incident response, collect and preserve ESI, perform SIEM and log analysis, manage eDiscovery and cross-region coordination, produce findings and remediation recommendations, and ensure regulatory and data-privacy compliance.

Plan and execute IT control testing across Technology, Cyber, Data and Change; document findings, manage risks and issues in AuditBoard, support remediation tracking, and contribute to risk reporting and governance to meet regulatory expectations.

Monitor, detect, investigate and respond to security alerts using Splunk Enterprise Security. Triage incidents, perform log analysis and event correlation, assist threat hunting and vulnerability remediation, escalate significant incidents, and maintain incident documentation and SOC use cases/playbooks.

Lead cybersecurity research and thought leadership, produce actionable insights and market analysis, advise senior clients on strategy and risk, support sales and events, mentor analysts, and drive research agenda and process improvements. Travel up to 25%.

Lead overnight SOC operations: conduct advanced investigations, incident response, and threat hunting; perform QC on Tier 1/2 work; mentor analysts; own escalations and client contact; improve runbooks and detection tuning; support monthly reporting and trend analysis.

Overnight Tier 2 SOC Analyst responsible for deep investigation, containment, and escalation of SIEM and EDR alerts, developing runbooks/SOPs, tracking vulnerabilities (Tenable), meeting SLA response/resolution targets, maintaining auditable tickets and shift logs, and communicating with clients and on-call leads.

Overnight SOC analyst monitors SIEM (Sentinel/Splunk) and EDR alerts, triages incidents per runbooks, validates vulnerabilities (Tenable), maintains auditable tickets and shift logs, escalates incidents, communicates with clients and on-call leads, and supports reporting and SOP improvements.

Monitor SIEM and security tooling, ingest and analyse logs from firewalls, networking and GPU infrastructure, triage and investigate alerts, perform threat hunting, coordinate incident response and remediation, track vulnerabilities, maintain runbooks, support compliance and audit activities, and communicate findings to engineering and operations.

Lead oversight of SAP access and SoD controls, develop SAP GRC policies and governance, review role design, perform control testing and risk reporting, and partner with Finance, Technology and Audit to drive compliance and continuous improvement.

Lead IT risk assessments, evaluate and document inherent and residual risks, partner with stakeholders to develop and monitor risk response plans, support enterprise IT risk and cyber security initiatives, maintain risk management procedures and best practices, and communicate risks across ITS and business units.

Research and analyze fraud detection mechanisms, abuse vectors, and platform vulnerabilities across web and mobile. Conduct OSINT/WEBINT investigations, build and operate research tooling and environments, analyze telemetry and datasets, automate research workflows, simulate abuse scenarios, monitor malicious channels, and produce actionable intelligence and mitigation recommendations.

Investigate and analyze fraud across web and mobile platforms using OSINT/WEBINT; identify tactics, vulnerabilities, and patterns in large datasets; monitor third-party channels and dark web; produce detailed reports with actionable mitigation recommendations.

Support and maintain GRC programs including data and system classification, vendor security assessments, SOC 2 audit coordination, policy lifecycle management, and remediation of control gaps across technical and business stakeholders.

Perform OSINT/WebINT investigations across websites, forums, and messaging platforms; monitor malicious activity; assess content policy suitability for vulnerable audiences; produce reports and actionable insights; support product and intelligence teams; analyze large datasets.

Research and analyze deep and dark web sources to assess threat actors and TTPs, produce technical intelligence reports for clients, collaborate with team leads and stakeholders, review and enrich analyst outputs, and maintain analytical procedures and security measures.

Lead insider risk and data loss investigations from triage to closure, operate and tune DLP across environments, build detections and workflows, partner with HR/Legal/Compliance/IT, mature insider risk program, support audits, and mentor others.

The L3 SOC Analyst leads complex incident investigations, drives automation, mentors junior analysts, and enhances SOC capabilities using advanced security technologies.

Conduct advanced OSINT and data mining across the surface and deep web to analyze mobile threats. Monitor forums, messaging channels, and dark web communities; extract large datasets; apply statistical, scripting, and AI techniques; translate findings into technical intelligence reports and actionable detection/enforcement recommendations; collaborate with technical teams to automate data collection and build lightweight tools.

Transform SOC operational data into actionable insights to improve MDR service delivery. Analyze workflows, identify gaps and trends, define performance metrics, validate improvements, integrate AI into analysis, conduct root-cause investigations, and collaborate with cross-functional teams to enhance quality, efficiency, and customer experience.

Perform end-to-end detection and response in a 24/7 SOC, investigate threats across identity, endpoint, network and cloud, mentor junior analysts, lead shifts, improve processes and automation, and collaborate with internal teams and customers.

Manage end-to-end Joiners, Movers, and Leavers (JML) processes to provision, modify, and remove access following least-privilege and RBAC principles. Maintain auditable access records, ensure approvals, liaise with data owners and stakeholders, support audits, document SOPs, and identify process automation and improvement opportunities while collaborating with HR, IT Security, Service Desk, and third parties.