Security Operations Analyst

About the Team

KPMG’s Cyber Security Office is responsible for defending the organisation, its clients, and digital assets against an evolving threat landscape. The Security Operations Centre (SOC) serves as the first line of defence, delivering round-the-clock monitoring, threat detection, incident response, and operational security support across internal and client environments.

You will join a collaborative group of experienced cyber security professionals focused on safeguarding critical systems, examining security incidents, and improving cyber resilience. This role offers strong exposure to modern security tooling, alert investigation, and response workflows while supporting your growth in cyber security.

Your Opportunity

As a SOC Analyst at Level 1, you will monitor and review security events, assist with incident investigations, and help keep the security operations function running effectively. Using leading security platforms, you will identify possible threats, assess alerts, and support response actions under the supervision of senior analysts.

This position suits someone who is genuinely interested in cyber security, eager to learn, and comfortable working in a fast-moving operational setting. It is designed to build technical, analytical, and investigative capability while contributing to the protection of business operations and critical infrastructure.

Key Responsibilities

• Track security alerts and events across enterprise networks, endpoints, cloud services, and monitoring platforms.
• Carry out first-pass analysis and alert triage to judge whether an event is valid, how serious it is, and what action is needed.
• Escalate suspicious or confirmed incidents to senior analysts following SOC procedures.
• Record investigation details, findings, and actions accurately in incident management systems.
• Assist with incident investigations by gathering evidence, validating alerts, and supporting prescribed response steps.
• Work within established incident response playbooks and operational runbooks.
• Help with containment and remediation tasks under senior guidance.
• Keep communication clear and coordinated during live incidents.
• Build understanding of common threats, attack methods, and indicators of compromise.
• Use SIEM and other monitoring tools to spot unusual behaviour, suspicious activity, and emerging risks.
• Support senior analysts in investigation and analysis work.
• Follow SOC workflows, processes, and shift handover routines.
• Maintain and improve SOC documentation, incident records, and operational playbooks.
• Look for ways to strengthen processes, alert quality, and documentation standards.
• Continue developing cyber security knowledge through training and hands-on experience.
• Take part in knowledge sharing and lessons learned sessions.
• Collaborate with SOC colleagues, technology teams, and wider cyber security stakeholders.
• Support client and stakeholder engagements where the SOC delivers managed or advisory security services.

Requirements

• Clear interest in cyber security and security operations.
• Basic understanding of cyber security concepts, including threats, vulnerabilities, and defensive controls.
• Working knowledge of SIEM platforms or other security monitoring tools.
• Ability to follow formal procedures and perform well in an operational environment.
• Strong written and verbal communication skills.
• Willingness to learn and develop technical and investigative capability.
• Prior exposure in a Security Operations Centre, IT operations, service desk, technology support, or a similar environment.
• Experience with cyber security monitoring, incident response, threat detection, or vulnerability management is advantageous.
• Familiarity with structured operations and escalation frameworks.
• Relevant tertiary qualification in Cyber Security, Information Technology, Computer Science, Information Systems, or a related field, or equivalent practical experience.
• Preferred certifications include CompTIA Security+, Microsoft Security Fundamentals (SC-900), Microsoft Security Operations Analyst (SC-200), Microsoft Azure Fundamentals (AZ-900), or related SOC/SIEM/incident response training.
• Ongoing commitment to professional development and learning in cyber security.

What KPMG Offers

You will join a values-led organisation that encourages curiosity, ongoing learning, and career growth. KPMG promotes an inclusive environment where diverse perspectives are welcomed and people are supported to do their best work.

The organisation also offers flexible ways of working in many areas, including flexible hours and locations, along with benefits such as paid parental leave, career breaks, retail discounts, health and wellbeing initiatives, learning and development opportunities, and salary packaging options.

KPMG also provides recruitment adjustments and additional support where needed during the hiring process.

Additional Information

KPMG is a professional services firm with international reach and broad industry experience. The business works with clients across many sectors to address complex challenges, guide change, and support growth.

The company values different perspectives and aims to create an equitable culture where team members can collaborate, learn from one another, and produce meaningful work.

KPMG encourages applications from candidates of all backgrounds, experiences, and identities. This role is a chance to grow a career in security operations within a supportive and inclusive team.