SOC Analyst (L2)

Advanced Security Monitoring: Analyse SIEM alerts, logs, and security events to identify and respond to complex threats.

Incident Response: Lead investigations, perform deep analysis, determine impact, and coordinate response activities.

Threat Detection & Analysis: Develop and refine detection rules and use cases to improve threat visibility.

Threat Hunting: Proactively hunt for advanced threats and indicators of compromise across the environment.

Vulnerability Management: Identify, assess, and prioritise vulnerabilities and recommend remediation actions.

Security Reporting: Produce detailed reports on incidents, trends, and overall security posture.

Process Improvement & Automation: Enhance SOC processes, playbooks, and automation capabilities.

Strong experience with SIEM platforms (e.g., Microsoft Sentinel, Sumo Logic)

Hands-on experience with EDR/XDR tools (e.g., CrowdStrike, Microsoft Defender)

Solid understanding of:

Incident response lifecycle

Threat detection methodologies

Networking protocols (TCP/IP, DNS, HTTP/S)

Experience analysing logs from multiple sources (endpoints, network, cloud)

Ability to independently investigate and resolve security incidents

Scripting or automation experience (e.g., Python, PowerShell) is a plus

Strong communication and stakeholder management skills, * UK Citizenship (required due to the nature of the role)