Cyber Threat & Vulnerability Analyst

Location and working arrangement

• Hybrid working in Basingstoke, with three office days per week and some monthly travel to the central London office.

Employment and benefits

• Permanent, full-time position.
• Annual bonus opportunity.

Role overview

Key responsibilities

• Analyze and triage vulnerabilities and exposures, validate findings, and identify issues requiring attention.
• Combine threat intelligence, exploitability, asset criticality, and business context to prioritize risk.
• Track remediation through resolution, establish ownership, and escalate blockers.
• Support external attack surface management and identify technology exposure.
• Analyze vulnerability data, identify trends and gaps, and produce reporting and management information.
• Support critical vulnerability response and improve vulnerability management with Cybersecurity Operations and technology teams.

What the candidate brings

• Good understanding of cybersecurity vulnerabilities and the vulnerability management lifecycle, from identification and prioritization to remediation and reporting.
• Understanding of CVEs, CVSS, exploitability, patching, compensating controls, and risk acceptance.
• Ability to analyze technical information or data, identify trends and priorities, and turn findings into clear actions.
• Experience working with technical teams to investigate issues, coordinate activity, or track actions through to resolution.
• Curiosity about cyber threats and motivation to develop expertise in threat and vulnerability management.
• Proactive, self-motivated approach and ability to manage competing priorities in a fast-paced environment.

Useful additional experience

• Exposure to Wiz, Tenable, Qualys, Microsoft Defender Vulnerability Management, Defender Advanced Threat Hunting, Burp Suite, or similar tools is useful.
• Familiarity with external attack surface management, penetration testing, security testing, threat intelligence, or Red or Purple Teaming is useful.
• Experience with ServiceNow, Jira, Power BI, KQL, PowerShell, or Python, or relevant cybersecurity training or certifications, is useful.