> Markdown version of [/jobs/ext/3946936-soc-analyst-sc-cleared](https://www.wearedevelopers.com/jobs/ext/3946936-soc-analyst-sc-cleared). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# SOC Analyst - SC Cleared

- **Company:** gb
Sanderson Government and Defence
- **Location:** Cheltenham, UK (Remote available)
- **Experience:** Experienced
- **Salary:** £143,000.0 - £156,000.0
- **Contract:** Temporary contract
- **Skills:** Cloud Computing, Cyber Security, Continuous Integration, Intrusion Detection and Prevention, Log Analysis, Parsing, Performance Tuning, Windows PowerShell, Release Management, Kusto Query Language, Security Information and Event Management, Software Repository, Scripting, Data Ingestion, Microsoft Power Automate, Mitre Att&ck, SC Clearance, Cybercrime, Microsoft Sentinel, Splunk
- **Published:** October 27, 2026
- **Apply:** https://www.totaljobs.com/job/information-security-analyst/sanderson-government-and-defence-job108238190

## About the Role

This role requires strong hands-on experience with Microsoft Sentinel, security telemetry and Kusto Query Language (KQL), alongside the ability to work autonomously within a fast-paced cyber security environment., * Active SC Clearance

 * Sole British National
 * Minimum 3 years' experience within a SOC, Detection Engineering, SIEM Engineering or Cyber Security Engineering role
 * Strong hands-on experience with Microsoft Sentinel
 * Advanced knowledge of Kusto Query Language (KQL)
 * Experience developing and maintaining Sentinel analytics rules and detection content
 * Understanding of the complete detection lifecycle, including development, testing, tuning and deployment
 * Experience working with Sentinel data connectors, Log Analytics, parsers and security telemetry
 * Strong troubleshooting skills across data ingestion, parsing and alert generation
 * Knowledge of MITRE ATT&CK
 * Understanding of identity, endpoint, network, cloud and infrastructure security monitoring
 * Experience using Git repositories and controlled deployment processes
 * Excellent communication and documentation skills
 * Ability to work independently in a remote environment

Desirable Skills

 * Splunk Enterprise Security experience
 * Knowledge of SPL query language
 * Microsoft Sentinel automation, Logic Apps or SOAR experience
 * Detection-as-Code and CI/CD pipeline experience
 * PowerShell or Python scripting skills
 * Experience supporting Threat Hunting or Incident Response activities

## Description

We're supporting a leading consultancy in the search for an experienced SOC Analyst to join their Cyber Security team on an initial 3-month contract. This is a fully remote opportunity for an analyst with strong Microsoft Sentinel and KQL expertise who can contribute immediately within a live Security Operations Centre (SOC) environment.

The successful candidate will play a key role in developing, tuning and maintaining security detections, ensuring the SOC receives high-fidelity, actionable alerts that support effective threat detection and response., As a SOC Analyst, you will focus on the development, validation and optimisation of detection content within Microsoft Sentinel. Working alongside SOC analysts, security engineers and technical stakeholders, you will help improve threat visibility, reduce false positives and ensure monitoring requirements are translated into effective detections., * Develop, test, deploy and maintain Microsoft Sentinel detection content

 * Write, optimise and tune KQL queries for analytics rules, investigations and validation activities
 * Convert security monitoring requirements into operationally effective detections
 * Validate detections against available telemetry and data sources
 * Tune and optimise existing analytics rules to improve alert fidelity and reduce false positives
 * Assess data connectors, parsers, normalisation and ingestion requirements
 * Investigate and resolve telemetry, parsing and alerting issues
 * Support change control, release management and deployment processes
 * Map detections to MITRE ATT&CK techniques and identify visibility gaps
 * Work closely with SOC teams to ensure alerts are actionable and relevant
 * Produce clear technical documentation, testing evidence and handover materials
 * Leverage automation and scripting where appropriate to improve efficiency