Senior IT Security Analyst, London

When you join EDF Trading, you’ll become part of a diverse international team of experts who challenge conventional ideas, test new approaches, and think outside the box.

Energy markets evolve rapidly, so our team needs to remain agile, flexible, and ready to spot opportunities across all the markets we trade in power, gas, LNG, LPG, oil, and environmental products.

EDF Group and our customers all over the world trust that their assets are managed by us in the most effective and efficient manner and are protected through expert risk management. Trading for over 20 years, it’s experience that makes us leaders in the field. Energy is what we do.

Become part of the team and you will be offered a great range of benefits, which include (location dependent) hybrid working, a personal pension plan, private medical and dental insurance, bi-annual health assessments, corporate gym memberships, an electric car lease programme, childcare vouchers, a cycle-to-work scheme, season ticket loans, volunteering opportunities, and much more.

Gender balance and inclusion are very high on the agenda at EDF Trading, so you will become part of an ever-diversifying family of around 750 colleagues based in London, Paris, Singapore, and Houston. Regular social and networking events, both physical and virtual, will ensure that you always feel connected to your colleagues and the business.

Who are we? We are EDF Trading, part of the EDF Group - a world leader in low-carbon, sustainable electricity generation.

Join us, make a difference, and help shape the future of energy.

Job Description:

Department

Information Technology (IT)

Position purpose

To act as a senior technical contributor within EDF Trading’s global cyber security team, owning selected cyber security domains end-to-end and driving practical improvements to reduce cyber risk.

The role combines analyst and engineering responsibilities across security tools, vulnerability and exposure management, web and email security, incident response, and threat-informed remediation.

The role works closely with infrastructure, cloud, application, identity and business teams to identify security issues, prioritise actions based on real-world attacker behaviour, and deliver measurable improvements to EDF Trading’s cyber defence posture.

To support EDF Trading’s cloud security by advising on, reviewing and improving Microsoft Azure and 365 security controls.

Main responsibilities

Cybersecurity Domain Ownership & Improvement (30%)

• Own one or more cyber security domains end-to-end, ensuring risks, controls, tooling, remediation activity and improvement backlogs are understood and actively managed.

• Identify weaknesses, exposures and control gaps across assigned domains and drive resolution with the relevant technical owners.

• Lead security improvement initiatives from analysis and design to implementation, documentation and operational handover.

• Translate threat intelligence, MITRE ATT&CK techniques and observed attacker behaviours into practical control improvements.

• Maintain clear domain-level documentation, including risks, controls, technical standards, operational processes and improvement plans.

• Provide senior technical input into security roadmaps and control improvement activities.

Security Tooling Administration & Engineering (25%)

• Administer, configure and continuously improve cyber security tools, including CrowdStrike, Zscaler ZIA/ZPA, and BeyondTrust Endpoint Privilege Management (EPM).
• Improve security tooling effectiveness by tuning configurations, reducing noise, improving visibility and increasing operational value.
• Design, build and deploy small tools, scripts, dashboards or automations to improve operations.
• Support integration of tooling into workflows, reporting and incident response processes.
• Maintain practical knowledge of Microsoft 365, Azure / Entra ID and Microsoft security controls, supporting improvements with the primary platform owners.
• Use automation and AI-enabled workflows responsibly to accelerate analysis, documentation, query development and repetitive operational tasks.

Vulnerability, Exposure & Threat-Informed Remediation (20%)

• Support vulnerability management by analysing weaknesses, validating risk, prioritising remediation and tracking material issues to closure.
• Apply threat intelligence, exploitation evidence, asset criticality and business context to prioritise remediation activity.
• Identify and manage exposure risks across endpoints, identity, SaaS, remote access and cloud-adjacent environments.
• Support attack path reduction activity across Active Directory, Entra ID and privileged access pathways.
• Use tools such as PingCastle and BloodHound Enterprise to identify identity-related weaknesses and drive remediation with infrastructure and identity teams.
• Advise technical teams on secure configuration and hardening improvements, including Active Directory, GPO, Microsoft 365, Azure Policy and identity controls.

Security Investigations & Incident Response (15%)

• Lead or support investigations into alerts, suspicious activity, phishing, endpoint events, identity anomalies and other cyber security incidents.
• Coordinate with the MDR provider, IT teams and system owners to validate detections, contain threats and complete remediation actions.
• Contribute to incident response playbooks, detection improvements, tabletop exercises and operational readiness activities.

Stakeholder Engagement, Mentoring & Governance Support (10%)

• Represent cyber security in technical discussions, project forums and governance meetings.
• Work closely with infrastructure, cloud, application, identity, service desk, compliance and business stakeholders to resolve security risks.
• Communicate risks, remediation options and recommended actions clearly to technical and non-technical stakeholders.
• 
  

Experience required

The successful candidate can demonstrate that they have:

• Operated as a senior technical contributor in cyber or infrastructure security.
• Owned or materially contributed to one or more cyber security domains, such as endpoint security, vulnerability management, identity security, network security, incident response or Microsoft 365 / Azure security.
• Used CrowdStrike or equivalent EDR tooling to investigate detections, support incident response and improve endpoint security controls.
• Used Zscaler ZIA/ZPA or equivalent secure web gateway, private access, zero trust or network access security technologies.
• Performed vulnerability assessment, exposure analysis or remediation prioritisation across enterprise technology environments.
• Applied threat intelligence, MITRE ATT&CK or exploitation-based evidence to prioritise mitigations.
• Supported or led cyber security investigations and incident response activities.
• Collaborated with infrastructure, cloud, application, identity and business teams to deliver security improvements.
• Used scripting, queries, automation or data analysis to improve security outcomes.

Technical requirements

Essential

• Strong hands-on experience administering, tuning and operationalising CrowdStrike Falcon, including endpoint protection, EDR investigations, detection analysis and response workflows.
• Strong hands-on experience administering and supporting Zscaler ZIA and ZPA, including policy design, access control, traffic analysis and security troubleshooting.
• Practical experience leading or supporting vulnerability and exposure management programmes, including vulnerability analysis, risk-based prioritisation, remediation tracking and validation of control effectiveness.
• Strong knowledge of real-world attacker tactics, techniques and procedures (TTPs) and the ability to translate threat intelligence, attack paths and exploitation trends into actionable security improvements.
• Experience conducting security investigations and incident response activities, including alert triage, root cause analysis, containment, remediation and lessons learned.

Desirable — some of the following (we don't expect any one candidate to have them all)

• Identity Security
• Active Directory and Group Policy security and hardening
• Entra ID security
• Conditional Access
• MFA design and implementation
• Identity governance
• Single Sign-On
• Attack Path Management
• PingCastle
• BloodHound Enterprise
• Attack path analysis and reduction
• Microsoft Security Technologies
• Microsoft Defender
• Microsoft Sentinel
• Microsoft Defender for Cloud Apps
• Microsoft 365 security controls
• Azure Policy
• Detection, Hunting & Automation
• Threat hunting
• Custom detections and security queries
• PowerShell or Python scripting
• Security automation and SOAR
• Certifications
• OSCP
• GCIH
• CISSP
• CISM
• SC-200
• SC-300
• AZ-500

Person specification

• Strong security mindset, with curiosity about how attacks work and how controls fail.
• Outcome-focused and accountable, with strong attention to accuracy and detail.
• Proactive, tenacious and comfortable solving ambiguous technical problems.
• Able to work independently while knowing when to escalate material risk or uncertainty.
• Comfortable balancing tactical operational demands with longer-term control improvement.
• Confident communicator who can explain technical issues clearly to different audiences.
• Collaborative and credible with infrastructure, cloud, application, identity and business stakeholders.
• Willing to mentor others and raise the technical capability of the team.
• Comfortable operating in a fast-paced trading environment with competing priorities.

Hours of work:

Core hours of 8.30am – 5.30pm; however, flexibility is required to meet essential business deadlines.

Hybrid working, with a minimum of 3 days in our London office.