Lead Analyst - Predictive Security Ops

The Analyst, Proactive Defense Operations will deliver the team's work and act as a senior hands-on contributor within Proactive Defense Operations (PDO). This is a hands-on analytical role within the team, focused on converting global threat data into validated, automated defensive action at machine speed.

About the team:

Proactive Defense Operations (PDO) moves GSK from an intelligence-and-reporting model to an automation- and engineering-centric capability. The team converts global threat data into immediate, validated operational actions, interrogating internal telemetry, triggering automated defenses and equipping defenders with contextualized, high-fidelity blueprints. PDO is organized into two operational pillars, Intelligence Automation and Threat & Context Analysis, and functions as the proactive defensive engine of Cyber Defense, working closely with Detection Engineering, SecOps/Incident Response and Vulnerability Management.

Key responsibilities:

• Deliver assigned work to agreed quality and timelines.
• Support colleagues with peer review and knowledge sharing.
• Monitor and dissect global threat streams, technical disclosures and campaign data to extract malicious behaviors and techniques (TTPs).
• Execute automated environment-check playbooks against centralized SIEM and data lake logs to establish enterprise exposure during emerging threat events.
• Compile high-fidelity Proactive Operational Packs (POPs) that deliver verified asset blast radius, adjusted risk profiles and pre-validated context to defenders.
• Leverage generative AI query and prompting frameworks to rapidly draft proactive behavioral detection logic (e.g. YARA-L, Sigma) for validation and deployment.
• Build and maintain the metrics that show whether the Cyber Defense function is getting ahead of threat activity.
• Partner with detection engineering, threat intelligence and threat exposure management to close predicted gaps.
• Establish the operating model for Proactive Defense Operations and mature it over time.

Basic Qualifications:

• Degree in a relevant discipline, or related experience.
• Demonstrated experience in security operations, detection engineering or security data science.
• Proficient in using centralized telemetry interfaces (SIEM, EDR, cloud logs) to run complex, multi-variable queries.
• 4+ years of hands-on experience in technical Cyber Defense, Threat Hunting or advanced Security Operations.
• Demonstrated ability to deliver work independently to a high standard.
• Strong attention to detail in analysis and documentation.

Preferred Qualifications:

• Experience with security data science, modelling or advanced analytics.
• Familiarity with MITRE ATT&CK and threat-informed defence practice.
• Experience with generative AI query and prompting frameworks for detection logic drafting.
• Data engineering or Python analytics skill.
• Relevant certification such as CISSP, GCIA, GCDA, GCTI.
• Experience in pharmaceutical, life sciences or another highly regulated industry.

Typical tools and technologies:

SIEM (e.g. Google SecOps), security data lake (e.g. Azure Data Lake), SOAR (e.g. Torq), Threat Intelligence Platform (TIP), MITRE ATT&CK Navigator, generative AI drafting tools, BI tooling.