Security Analyst II

Job description

As a Security Analyst II, you will play a critical hands-on role within the SOC, delivering high-quality investigations and proactive monitoring to protect the organisation from evolving threats. This position demands strong analytical capability, investigative depth, and technical expertise to solve complex challenges under pressure.

You will leverage your knowledge of operating systems, networking, and security principles to identify, analyse, and contain threats quickly and effectively. You will use advanced querying and technical skills to uncover patterns, validate alerts, and drive improvements in detection and response.

You will act as a trusted member of the SOC team, collaborating with peers and partners to strengthen detection and response capabilities. Beyond day-to-day operations, you will contribute to process improvements, automation initiatives, and SOC maturity objectives.

• Monitor and analyse security events using Security platforms, applying advanced queries to identify and validate threats.

• Deliver accurate and timely investigative analysis, ensuring rapid containment and remediation of incidents.

• Act as a key responder during active incidents, applying technical knowledge to diagnose root causes and mitigate impact.

• Conduct proactive threat hunting to uncover unknown threats and strengthen early detection capabilities.

• Utilise deep understanding of operating systems, networking protocols, and security principles to resolve complex challenges.

• Maintain situational awareness of emerging attacker techniques, vulnerabilities, and threat trends.

• Support development and optimisation of SOC playbooks, processes, and automation use cases.

• Collaborate with Incident Managers, Threat Intelligence, and other teams for unified response and knowledge sharing.

• Produce clear, actionable reports for technical and non-technical audiences.

• 2+ years' experience in SOC operations or equivalent security monitoring role.

• Strong investigative and analytical skills with proven ability to handle complex incidents under pressure.

• Proficiency in SIEM/XDR platforms and advanced querying (e.g., KQL, SPL) for threat detection and analysis.

• Solid understanding of operating systems (Windows, Linux), networking concepts (TCP/IP, DNS), and security fundamentals.

• Familiarity with incident response frameworks (e.g., NIST, MITRE ATT&CK).

• Ability to prioritise and manage multiple cases concurrently in high-stakes environments.

• Strong communication skills for technical and non-technical stakeholders.

• Experience with scripting languages (e.g., Python, PowerShell).

You might know us as a supermarket, technology company or even for our award-winning mobile network. Truth is, we're all of those things, and much more. Our colleagues work with one goal in mind, helping to make every day a little better for our customers, colleagues and communities all over the world. No two customers are the same, neither are our colleagues.

At Tesco, we champion a balance that lets you thrive both in and out of work. Spend 60% of your week collaborating with colleagues at our office locations or local sites and the rest remotely. Whether you're just kicking off your career, juggling passions, or navigating big life events, we're here to support you. We always welcome a conversation about flexible working, so talk to us throughout your application about how we can support.

We're proud to be an accredited Disability Confident Leader, where everyone's welcome. That's why we commit to providing a fully inclusive and accessible recruitment process. If you need support with your application, click here for more information. And if you're interested in joining our team but don't tick every box, don't let that hold you back from applying.

When you join us in this role, you'll be employed by Tesco Stores Limited, the Tesco legal entity responsible for your employment.