Information Security Analyst, Starling Bank

• 5+ years in a technical security role, such as detection engineering, threat hunting, incident response, or threat intelligence
• Attacker Knowledge: Practical experience analysing attacker behavior, with a strong understanding and application of threat analysis models like MITRE ATT&CK to prioritize and enhance detective controls
• SIEM Expertise: Hands-on experience with SIEM platforms (e.g., Splunk, Google SecOps, Elastic, Sentinel) for rule/query creation and analytics
• Threat Hunting: Experience conducting proactive threat hunts, defining hypotheses, and developing hunting methodologies
• Cloud Security: Solid knowledge of security risks and detection strategies for AWS, GCP, Azure
• EDR Proficiency: Experience with EDR tools (e.g., Crowdstrike, SentinelOne, Cortex XDR)
• Core Technical Skills: Good understanding of OS internals (macOS, Linux, Windows) and network security principles
• Key Attributes: Excellent analytical, problem-solving, and communication skills. Self-starter, able to lead projects, and highly collaborative
• Growth Mindset: Eagerness to learn and apply knowledge to new security challenges

Desirable

• We’re seeking a passionate and skilled Detection Engineer and Threat Hunter to join our growing Security Operations team, and proactively defend Starling Bank against emerging threats
• Reporting to the Information Security Lead - Detection, the analyst’s primary responsibility will be to proactively identify and defend against potential threats to the bank
• You will achieve this by developing, tuning, and maintaining detection rules, conducting intelligence-driven threat hunts, and participating in collaborative defence improvement activities like Purple Teaming to identify and mitigate risks before they impact the bank
• Detection Engineering - Design, build, test, and maintain high-fidelity detection rules and analytics in our SIEM and other security platforms
• Proactive Threat Hunting - Formulate hypotheses and hunt for undetected attacker TTPs across our cloud (AWS, GCP, Azure), SaaS, and endpoint environments
• Purple Team - Collaborate with our Adversarial Simulation team in Purple Team exercises to test, validate, and improve detection logic and response
• Incident Response SME support - Act as a Subject Matter Expert during security incidents, providing deep technical analysis and aiding remediation
• Threat Intelligence integration - Integrate and operationalise threat intelligence to inform detection strategies and hunting projects
• Collaboration - Work closely with the wider Security Operations team, and other stakeholders to uplift Starling's security posture and improve detective controls
• Documentation - Maintain clear documentation for detection rules, hunting playbooks, and processes

• Our interviews are conversational and we want to get the best from you, so come with questions and be curious. In general you can expect the below video interviews, following a chat with one of our Talent Team:
• First Interview: 45 minutes
• Technical Interview: 90 minutes
• Final Interview: 30 minutes
• As a regulated bank, we require our successful candidates to go through background checks (including but not limited to social media, employment references, fraud checks and criminal history)