Senior Security Analyst

Job Description Tesco Technology are looking for a Senior Security Analyst reporting into the Vulnerability Management team. This is an exciting opportunity for a highly motivated security focused individual to join our expanding organisation. The scale and complexity of Tesco creates a huge opportunity for someone to apply their existing skills while developing new ones and make a difference to the millions of customers we serve.

The role will involve being hands on with a focus on the availability and reliability of our data and reporting whilst having the freedom to leverage your knowledge and real-world experience to work with other teams and help drive innovation across our prevention, detection, and remediation capabilities. Your job is to provide actionable insight into the security posture of our systems and platforms prioritising remediation activities for our engineering colleagues and system owners to remediate as well as assurance that effective security controls and guardrails are in place across our on-prem and public cloud environments.

Following our Business Code of Conduct and always acting with integrity and due diligence and have these specific risk responsibilities:

Maintaining vulnerability scanning platforms to identify and analyse vulnerabilities.
Taking a risk-based approach to prioritise remediation efforts.
Working with engineering teams to remediate issues.
Building a range of reporting capabilities to inform our stakeholders on the status and progress of VM remediation efforts across engineering and up to leadership and C level.
Data correlation and identifying patterns and trends.
Reviewing submissions from our active Bug Bounty Programs.
Develop Guardrails and Standards to reduce exposure to vulnerabilities.

You will be responsible for

Building our detection, data correlation and response capabilities in the VM space. As a team we also feed into the standards and patterns for our engineering community.
Create tooling and reporting to help manage our external attack surface.
Build a range of capabilities to inform our stakeholders on the status and progress of VM remediation efforts across the company.
Automate integrations between platforms and tooling.
Use your observations from security incidents and reporting about relevant security threats to contribute to our internal detection engineering programme.
Work alongside our analysts to upskill them in Vulnerability Management and look for patterns and issues that can be fixed centrally.
POC assessments from our active Bug Bounty Program.

You will need:

5+ Years of experience working in the IT Security Industry
Experience with responding to security incidents in large scale corporate environments.
A good understanding of Bug Bounty programmes.
Proficiency in at least one programming or scripting language such as Python, Power Shell, Terraform or similar.
Solid understanding of networking, web services and application testing.
Experience with Vulnerability Scanning tools such as Qualys and Tenable etc.
Keen to cultivate a culture of collaboration, innovation and bringing industry standards to everything we do.
Proactive and able to operate independently. Comfortable with ambiguity.
You are resilient – you take ownership of seeing issues through to resolution whilst looking after yourself to be at your best.
Have a passion for technology and can share that passion with others.