Iceland are looking for a skilled and experienced Cyber Security Analyst to join the Cyber Operations and Engineering team.

This is a hands-on role at the heart of our day-to-day cyber security operation. You will help protect a large, diverse technology estate, investigating security alerts and incidents, monitoring identity and endpoint risk, managing vulnerabilities and working with teams across IT to turn security findings into practical remediation.

We are looking for someone who enjoys investigating problems rather than simply passing alerts on. You'll need to be naturally curious, comfortable working across Microsoft security technologies and able to follow an investigation from initial detection through to remediation.

The role combines security operations, incident response, vulnerability management, identity security, threat monitoring and security engineering, with the opportunity to develop further as our Cyber Security capability continues to evolve.

What you’ll be doing

Security monitoring & incident response

You'll be part of the operational response to cyber security incidents, helping to triage, investigate, contain and remediate threats.

Typical activities include:

• Investigating security incidents and alerts in Microsoft Defender XDR.
• Determining whether suspicious activity is legitimate or malicious.
• Investigating affected users, devices and indicators of compromise.
• Analysing suspicious emails, URLs and attachments.
• Performing containment and remediation actions where appropriate.
• Investigating potentially compromised identities and suspicious sign-in activity.
• Documenting investigations, decisions and actions taken.
• Working with our external security services and internal IT teams during investigations.

Identity security

Identity is a major part of the role. You'll investigate risky users and risky sign-ins within Microsoft Entra ID, analysing sign-in and audit activity and establishing whether apparently suspicious behaviour is legitimate.

You'll regularly work with:

• Microsoft Entra ID
• Identity Protection
• Conditional Access
• Sign-in and audit logs
• Advanced Hunting/KQL

Vulnerability management

A significant part of the role will be identifying, investigating and driving remediation of vulnerabilities across Iceland's technology estate.

You won't simply produce vulnerability reports. You'll work with the teams that own the affected systems to understand the exposure, establish remediation plans and make sure vulnerabilities don't disappear into a backlog.

Activities will include:

• Monitoring for newly disclosed vulnerabilities and CVEs.
• Assessing their relevance and potential impact to Iceland.
• Identifying affected assets and services.
• Coordinating investigation and remediation with technical teams.
• Tracking vulnerability remediation, ownership, status and target dates.
• Escalating overdue or high-risk vulnerabilities.
• Identifying recurring vulnerabilities and helping tackle their underlying causes.
• Looking for opportunities to improve patching, remove unnecessary software or introduce technical controls that reduce future exposure.

Security engineering & continuous improvement

We want someone who is interested not just in finding problems, but in making the environment more secure.

You'll have opportunities to contribute to technical security improvements across endpoint, cloud and identity environments.

Working across IT

Cyber Security doesn't operate in isolation.

You'll work closely with infrastructure, endpoint, cloud, service desk and other technical teams to investigate issues and drive remediation.

The technology you'll work with

Experience across all of these isn't essential, but our environment and operational processes make use of technologies including:

• Microsoft Defender XDR / Defender for Endpoint
• Microsoft Entra ID and Identity Protection
• Microsoft Sentinel
• Microsoft Defender for Cloud
• KQL and Advanced Hunting
• Conditional Access
• ANY.RUN
• Azure and Microsoft 365 security tooling

What we're looking for

We're looking for someone with a solid grounding in cyber security who wants a role where they can get involved rather than simply observe.

You'll ideally have experience of most of the following:

• Security operations or SOC activities.
• Incident investigation and response.
• Vulnerability management.
• Microsoft Defender.
• Microsoft Entra ID.
• Analysing security logs and identifying unusual behaviour.
• KQL.

Just as importantly, we'd like someone who:

• Is naturally inquisitive and wants to understand why something happened.
• Can think analytically rather than treating every alert as a checklist exercise.
• Takes ownership of investigations and follows them through.
• Can distinguish genuine risk from legitimate but unusual activity.
• Is comfortable challenging something that doesn't look right.
• Can explain technical security issues clearly to non-security colleagues.
• Works collaboratively with other technical teams.
• Has an interest in the wider cyber threat landscape.
• Looks for permanent improvements, rather than repeatedly fixing the same problem.
• Wants to continue learning and developing technically.

This role is based in our Deeside head office, with a minimum of 2 days per week spent working from here.

Why join us?

Alongside the opportunity to work on meaningful projects in a business that values innovation and collaboration, you'll enjoy:

• 15% discount in Iceland stores
• 33 days holiday (including bank holidays)
• Free onsite parking
• Electric vehicle charging facilities
• Subsidised staff restaurant and Costa Coffee
• Christmas vouchers
• Refer a Friend scheme
• Christmas Savings scheme
• Discounted dry cleaning
• Long service awards