SOC Analyst

As a Senior Security Analyst, you’ll play a key role in protecting the organisation against cyber threats through proactive security monitoring, threat detection, investigation and incident response. Working within a collaborative global Security Operations Centre (SOC), you’ll be responsible for identifying suspicious activity, analysing security alerts and responding effectively to potential security incidents. This role offers the opportunity to work across a broad range of security technologies, with a particular focus on SIEM platforms, incident investigation, threat detection and response. You’ll contribute to improving detection capabilities, strengthening incident response processes and enhancing the organisation’s overall security posture., Monitor, analyse and investigate security alerts generated through SIEM platforms, EDR solutions and other security monitoring technologies. Perform detailed triage of security events, distinguishing genuine threats from false positives and determining appropriate escalation or remediation actions. Lead or support incident response activities, including investigation, containment, eradication, recovery and post-incident analysis. Investigate suspicious activity across endpoints, networks, identities, applications and cloud environments to identify potential security compromises. Utilise SIEM technologies such as Microsoft Sentinel, Splunk or QRadar to correlate security events, investigate threats and identify indicators of compromise. Analyse security logs, authentication events, endpoint telemetry and network activity to identify malicious behaviour and emerging threats. Conduct threat hunting activities using threat intelligence, indicators of compromise (IOCs) and attacker techniques to identify potential security risks. Work closely with Security Engineering, Infrastructure and wider IT teams to coordinate effective incident response and remediation activities. Develop, refine and optimise SIEM detection rules, alerting logic and security monitoring use cases to improve detection capabilities and reduce false positives. Contribute to the development and continuous improvement of SOC processes, incident response playbooks and operational procedures. Produce clear incident reports, documenting investigation findings, actions taken, root causes and recommendations for future prevention. Support the implementation and improvement of security monitoring tools, processes and technologies across the organisation. Technical Skills Experience across several of the following areas would be advantageous: Security Operations & Monitoring Security Operations Centre (SOC) Security Information and Event Management (SIEM) Microsoft Sentinel, Splunk, QRadar or similar SIEM platforms Security Event Monitoring & Alert Triage Log Analysis & Event Correlation Security Detection Engineering Security Orchestration, Automation & Response (SOAR) Incident Response & Threat Detection Security Incident Investigation & Response Incident Containment, Eradication & Recovery Endpoint Detection & Response (EDR) Microsoft Defender XDR CrowdStrike Falcon Threat Hunting & Threat Intelligence Indicators of Compromise (IOCs) MITRE ATT&CK Framework Malware Analysis & Investigation Phishing Investigation & Response Vulnerability Management Additional Technical Knowledge Kusto Query Language (KQL) Windows & Linux Security Network Security Fundamentals Identity & Access Management (IAM) Microsoft Entra ID (Azure AD) Microsoft 365 Security Azure & AWS Security Monitoring Cloud Security Fundamentals PowerShell or Python Scripting

Strong experience working within a Security Operations Centre (SOC) or dedicated security monitoring and incident response function. Hands-on experience using SIEM technologies to investigate security alerts, correlate events and identify potential threats. Proven experience investigating and responding to security incidents, with an understanding of the full incident response lifecycle. Experience working with EDR/XDR technologies to investigate suspicious endpoint activity and potential compromises. Strong understanding of common cyber threats, attack techniques and indicators of compromise. Ability to analyse security logs and telemetry from multiple sources to identify malicious or unusual activity. Strong analytical and investigative skills, with the ability to prioritise incidents based on severity, impact and business risk. Experience contributing to improvements in detection rules, SOC processes and incident response procedures. Excellent communication skills, with the ability to document investigations and communicate technical findings clearly. A proactive, collaborative approach to security operations, with a focus on continuous improvement.

Even if this position is not right for you, we may have others that are. Please visit MCS Group to view a wide selection of our current jobs.