Senior Cyber Security Analyst, Y TREE

• Security Frameworks & Regulation: Experience with security-focused frameworks (e.g., CIS, NIST, ISO) and a track record of applying security controls in an FCA-regulated environment, with an understanding of key regulatory guidelines (e.g., GDPR, DORA)
• Threat Detection & Cloud Security: Experience with intrusion detection, prevention, and management (e.g., SIEM) alongside vulnerability management on cloud systems and applications (ideally AWS and Kubernetes)
• Incident & Penetration Expertise: Experience leading incident response and management, with familiarity in pen testing of applications and infrastructure
• Application Security: Familiarity with OWASP principles, web application security, security practices on native mobile apps (iOS and Android), and security-by-design principles
• Tooling & Threat Landscape: Familiarity with project management tools (Confluence, Jira, ServiceNow) and a good understanding of the threat landscape and risks from emerging technologies (like AI)
• Leadership & Growth: Comfortable taking the lead when required, eager to learn, and passionate about technology with a drive for continuous professional development
• Mindset & Collaboration: An organised, meticulous, independent, and critical thinker who is an effective collaborator, open to feedback, and capable of identifying issues and building logical steps to overcome them
• Communication Skills: Excellent written and verbal English skills, able to clearly articulate thoughts and ideas during interpersonal communication within our community

Desirable

• The role will be part of the Technology team and will report into the CTO
• This role will work closely with multiple Technology disciplines and other internal and external teams to establish a strong set of cyber controls for the Y TREE business
• This is a hands-on role with a wide range of responsibilities including monitoring, detection, response and remediation of security risks, threats and vulnerabilities
• The ultimate goal is to holistically improve Y TREE’s security posture to meet the demands of its clients and its regulators
• This is a great opportunity for the right individual to make their mark and support the growth of a scale-up organisation
• Security Posture Improvement: Act as a hands-on Security Analyst, closely interacting with multiple technology disciplines to collectively improve the security posture of Y TREE’s technologies
• SOC Collaboration & Incident Response: Collaborate with an externally-managed SOC; act as the escalation point for Y TREE, triage and prioritise issues, manage the issue lifecycle, and lead incident response
• Vulnerability Management: Carry out security scanning; detect and manage vulnerabilities to resolution and reduce operational risks using commercial (CrowdStrike) and open-source technologies (Trivy) in AWS-hosted applications and infrastructure
• Monitoring & Mitigations: Manage security monitoring and alerts to understand attack vectors and introduce mitigations
• Automation & LLMs: Use tools and automation (including LLMs) to carry out common security operations tasks
• Routine Security Testing: Introduce and embed tools to enhance Y TREE’s internal capabilities for routine security testing activities, and monitor/enhance security on CI/CD pipelines (SAST, DAST and SCA testing)
• Risk & Remediation Tracking: Maintain a register of security risks and remediations; work closely with Technology, Risk, and Compliance teams to track and close issues
• Certifications & Policies: Support Y TREE’s efforts in maintaining current cyber security certifications and achieving higher accreditations, while maintaining/enhancing policies, documentation, and reporting on cyber metrics
• Advocacy & Awareness: Elevate cyber security awareness across the organisation and champion best practices
• External Audits: Collaborate with external cyber security consultants for external reviews, audits and assessments