Senior SOC Analyst

Key responsibilities

• Monitor the organisation's technology estate for cyber events, suspicious activity and indicators of compromise.
• Independently investigate security alerts and complex cyber events.
• Assess the significance, potential impact and appropriate response to identified threats.
• Correlate information from multiple technical sources to establish attack timelines and identify affected systems.
• Analyse indicators of compromise, attacker techniques and threat intelligence.
• Escalate confirmed or suspected incidents to the Lead SOC Analyst or Incident Response team.
• Provide Incident Responders with accurate findings, evidence, timelines and technical information.
• Validate monitoring content, detection rules and operational procedures before live deployment.
• Support the onboarding of new systems, applications and cloud services into SOC monitoring.
• Maintain accurate and fully documented investigation records.
• Mentor and provide technical guidance to developing SOC Analysts.
• Contribute to detection tuning, monitoring improvements and post-incident reviews.

Essential skills and experience

• Experience working within a SOC or comparable cybersecurity operations environment.
• Strong experience investigating cybersecurity alerts using enterprise monitoring technologies.
• Good knowledge of SIEM platforms, security-monitoring tools and log-analysis techniques.
• Understanding of cyberattack methodologies, indicators of compromise, threat intelligence and common attacker techniques.
• Experience analysing data from multiple technical sources to investigate security events.
• Experience supporting cyber incident-response activities.
• Knowledge of intrusion detection, forensics, protective security, risk management and secure operations.
• Strong analytical and problem-solving skills with sound technical judgement.
• Ability to produce accurate technical reports and investigation findings.
• Ability to operate effectively within a 24/7 shift environment.
• Relevant certification such as Microsoft SC-200, CompTIA CySA+, GIAC, GCIA or equivalent.
• Experience of Microsoft Sentinel, LogRhythm, MITRE ATT&CK, NCSC guidance, detection tuning or working within Government, Defence, Critical National Infrastructure or similarly regulated environments would be advantageous.

Working arrangements

This is a fully site-based position at Hanslope Park, Milton Keynes, with no hybrid or remote-working options.

The role operates a 24/7/365 Panama rota, including 12-hour day and night shifts.

Security clearance

Applicants must be British nationals and capable of obtaining UK Government Developed Vetting, DV clearance.

Existing DV clearance is not essential, but candidates who currently hold an active DV clearance will be at a significant advantage, particularly given the urgent nature of the requirement.