> Markdown version of [/jobs/ext/3613941-soc-analyst](https://www.wearedevelopers.com/jobs/ext/3613941-soc-analyst). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# SOC Analyst

- **Company:** Roc Search
- **Location:** London, UK
- **Contract:** Permanent contract
- **Skills:** Microsoft Windows, User Authentication, Microsoft Azure, Cloud Computing, Cyber Security, Computer Networks, Data Loss, Linux, Digital Forensics, Identity and Access Management, Intrusion Detection and Prevention, Python (Programming Language), Network Security, Packet Analyzer, Windows PowerShell, Anti-Phishing, Kusto Query Language, Security Information and Event Management, Wireshark, Data Logging, Mitre Att&ck, Malware, Cybercrime, Microsoft Sentinel, CIS Benchmarks, Encase
- **Published:** October 8, 2026
- **Apply:** https://www.reed.co.uk/jobs/soc-analyst/57437090

## About the Role

* Practical experience in cyber security incident response, security monitoring or a SOC environment.
 * Hands-on experience with SIEM and EDR/XDR technologies.
 * Experience investigating Windows and Linux systems, authentication activity, security logs and network traffic.
 * Strong understanding of the incident response lifecycle.
 * Knowledge of MITRE ATT&CK, Cyber Kill Chain and NIST.
 * Good understanding of enterprise networking, IAM, cloud, email and endpoint security.
 * Experience with digital forensics and evidence handling.
 * Strong communication, investigation and analytical skills.

Desirable

 * Banking, financial services or other regulated-sector experience.
 * Microsoft Sentinel, Defender XDR, Defender for Identity or Defender for Cloud.
 * KQL, PowerShell, Python or similar scripting/automation.
 * Threat hunting, malware analysis and detection engineering.
 * Azure and Microsoft 365 investigation experience.
 * EnCase, FTK, Velociraptor, Volatility or Wireshark.
 * Certifications such as GCIH, GCIA, GCFA, GNFA, SC-200, CySA+ or CISSP., Relevant cyber security experience, degree or equivalent practical experience. Knowledge of NIST, CIS Controls and recognised information security standards.
Not what you are looking for?

## Description

* Monitor and investigate alerts from SIEM, EDR/XDR, identity, email, cloud and network security technologies.
 * Triage incidents, assess severity and business impact, and coordinate containment, eradication and recovery.
 * Investigate phishing, malware, account compromise, data loss, unauthorised access and suspicious network activity.
 * Collect, preserve and analyse endpoint, server, identity, network, email and cloud artefacts.
 * Analyse logs, packet captures, forensic images and security telemetry to establish scope, root cause and attacker activity.
 * Identify IOCs, attacker behaviours, TTPs and map findings to MITRE ATT&CK where appropriate.
 * Develop and execute threat hunts and contribute to detection rule, monitoring and logging improvements.
 * Maintain incident records, investigation timelines, evidence and post-incident reports.
 * Develop and maintain incident response playbooks, procedures and communication processes.
 * Conduct post-incident reviews, root-cause analysis and lessons-learned activities.
 * Provide clear technical and management updates to senior stakeholders.