Cyber Incident Response Analyst

About the Role

The Incident Response Analyst is a key member of the Cyber Security Incident Response function, responsible for detecting, triaging, investigating, containing, and coordinating the resolution of cyber security incidents across Mizuho EMEA. The role combines security monitoring, incident handling, threat hunting, and digital forensics to reduce business impact, preserve evidence, and improve organizational resilience. The job holder will work with technology, business, risk, legal, compliance, and third-party stakeholders throughout the incident lifecycle. The role will also contribute to playbooks, detection engineering, threat intelligence integration, post-incident reviews, and management reporting.

Key Responsibilities

Incident Detection, Triage, and Response

• Monitor and analyze alerts from SIEM, EDR/XDR, identity, email, cloud, network, and other security controls to identify suspicious or malicious activity.
• Triage alerts, validate incidents, determine severity and business impact, and escalate in line with the incident response process and defined service levels.
• Lead or support investigations into internal and external threats, including phishing, malware, account compromise, data loss, unauthorized access, and suspicious network activity.
• Coordinate containment, eradication, and recovery activities with infrastructure, application, identity, cloud, and business teams, maintaining clear ownership and decision records.
• Maintain accurate incident case records, investigation timelines, evidence, actions, decisions, and closure rationale from initial detection through to resolution.
• Provide timely incident updates and concise technical and management reports, including material facts, impact, risk, actions, dependencies, and next steps.

Digital Forensics and Investigation

• Collect, preserve, and analyze endpoint, server, identity, network, email, and cloud artifacts in accordance with approved forensic and evidence-handling procedures.
• Perform host and network analysis using logs, packet captures, forensic images, and security telemetry to establish scope, root cause, attacker activity, and affected assets.
• Identify indicators of compromise, tactics, techniques, and procedures, and map findings to MITRE ATT&CK where appropriate.
• Support legally or regulatorily sensitive investigations by maintaining evidence integrity, chain of custody, and appropriate access controls.
• Engage specialist internal or external forensic support where the complexity, scale, or sensitivity of an incident requires additional expertise.

Threat Hunting and Detection Improvement

• Develop and execute hypothesis-led threat hunts using threat intelligence, environmental knowledge, and observed attacker behaviors.
• Create, tune, and validate monitoring use cases, correlation rules, queries, custom indicators, and detection content to improve coverage and reduce false positives.
• Assess detection gaps identified during incidents and recommend enhancements to logging, telemetry, processes, and security controls.
• Contribute to purple-team, penetration-testing, and control-validation activities and ensure relevant findings are converted into actionable detection or response improvements.

Incident Response Capability and Governance

• Develop, maintain, and exercise incident response plans, standard operating procedures, playbooks, call-out arrangements, and stakeholder communication templates.
• Conduct post-incident reviews and root-cause analysis, track lessons learned, and ensure agreed corrective actions are assigned and monitored to closure.
• Contribute to incident response metrics, key risk indicators, trend analysis, and control-effectiveness reporting for management and governance forums.
• Support cyber exercises and simulations to validate roles, escalation paths, communications, and decision-making under realistic incident conditions.
• Keep current with emerging threats, vulnerabilities, attack methods, and changes to relevant industry frameworks and regulatory expectations.

Requirements & Tech Stack

Essential

• Practical experience in cyber incident response, security monitoring, or a Security Operations Centre environment.
• Hands-on experience investigating security alerts and incidents using SIEM and EDR/XDR technologies.
• Experience analyzing Windows and Linux host artifacts, authentication activity, security logs, network traffic, and packet captures.
• Working knowledge of incident response lifecycle activities including preparation, detection, analysis, containment, eradication, recovery, and lessons learned.
• Experience producing incident records, investigation reports, management updates, and post-incident findings.
• Understanding of attacker behaviors and frameworks including MITRE ATT&CK, Cyber Kill Chain, and NIST incident response guidance.
• Knowledge of enterprise networking, identity and access management, cloud services, email security, endpoint security, vulnerability management, and data loss prevention.
• Ability to manage multiple priorities, exercise sound judgment under pressure, and communicate clearly with technical and senior stakeholders.
• Awareness of evidence handling, forensic integrity, confidentiality, and regulatory considerations relevant to cyber investigations.

Desirable

• Experience in banking, financial services, or another regulated environment.
• Experience with threat intelligence, malware analysis, scripting, or automation using PowerShell, Python, KQL, or similar languages.
• Experience developing detection rules, response playbooks, threat hunts, or security orchestration and automation workflows.
• Knowledge of Microsoft security technologies such as Sentinel, Defender XDR, Defender for Identity, and Defender for Cloud, or equivalent platforms.
• Exposure to forensic tools such as EnCase, FTK, Velociraptor, Volatility, Wireshark, or equivalent.
• Understanding of cloud investigation techniques across Microsoft Azure, Microsoft 365, or other major cloud platforms.

Qualifications

• Relevant professional experience supported by a degree in cyber security, computer science, or a related discipline, or equivalent practical experience.
• One or more relevant certifications such as GCIH, GCIA, GCFA, GNFA, SC-200, CySA+, CISSP, or equivalent are desirable.
• Sound knowledge of information security principles, recognized standards, and regulatory expectations, including NIST, CIS Controls, and relevant privacy requirements.