Cyber Security Analyst, Doctor Care Anywhere

• This is a hands-on role ideal for someone with 4–5 years’ experience in a similar position, who thrives in a fast-paced, cloud-first environment and enjoys working collaboratively across technology and business teams
• We don’t just safeguard data - we safeguard the digital heartbeat of healthcare
• 4–5 years’ experience in a Cyber Security Analyst or SOC Analyst role
• Strong understanding of Microsoft security tools (Defender 365, Sentinel, Entra ID, Intune)
• Familiarity with Azure environments and cloud security concepts
• Experience with incident response and vulnerability management processes
• Understanding of ISO/IEC 27001:2022, NCSC guidance, and UK GDPR principles
• Proficient in log analysis, KQL querying, and security reporting
• Excellent analytical, documentation, and communication skills
• Experience with scripting (PowerShell or Python) for automation
• Familiarity with UK healthcare regulatory frameworks (CQC, GDPR, and DSPT)
• Microsoft Certified: Azure Security Engineer Associate (AZ-500)
• NCSC-Assured Incident Response or Security Operations Training

Desirable

• The Cyber Security Analyst will play a key role in protecting DCA’s digital assets, patient data, and cloud infrastructure
• Working within the Digital Security team, you’ll monitor, analyse, and respond to security alerts across Microsoft Defender 365, Sentinel, Azure, and other core systems
• You’ll support vulnerability management, incident response, and continuous improvement of our ISO 27001:2022-aligned Information Security Management System (ISMS)
• Review and triage alerts from Microsoft Defender 365, Sentinel, and related security platforms
• Conduct initial investigation, analysis, and escalation of potential incidents
• Maintain dashboards, reports, and metrics on cyber activity and response times
• Support the Head of Digital Security during security incidents and investigations
• Perform root cause analysis and document findings in line with ACPO guidelines and internal CAR (Corrective Action Record) processes
• Liaise with external partners (e.g., Microsoft, NCSC) during threat events
• Review vulnerability data from Defender for Endpoint, Rapid7 and Azure tools
• Support remediation tracking through Jira workflows
• Assist in planning and validating annual penetration tests and follow-up activities
• Support ISO 27001:2022 control monitoring and evidence collection
• Contribute to internal audits, awareness campaigns, and phishing simulations
• Assist with Data Security Posture Management and Purview monitoring
• Proactively suggest improvements to automation, alerting, and response processes
• Help refine KQL queries and Sentinel playbooks to improve detection capability
• Support secure configuration reviews and cloud posture assessments

• Application Deadline; 9am Monday 27th October - Applications may close early depending on application volume