> Markdown version of [/jobs/ext/3977843-soc-l3-analyst](https://www.wearedevelopers.com/jobs/ext/3977843-soc-l3-analyst). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # SOC L3 Analyst - **Company:** AtkinsRéalis - **Location:** Epsom, UK - **Contract:** Permanent contract - **Skills:** Data Analysis, Microsoft Azure, Cyber Security, Digital Forensics, Monitoring of Systems, Internet Protocol, Intrusion Detection and Prevention, Security Information and Event Management, Software Vulnerability Management, Mitre Att&ck, Malware, Cyber Threat Analysis, Agentic-AI, Cybercrime, Security Orchestration, Automation & Response - **Published:** October 28, 2026 - **Apply:** https://slihrms.wd3.myworkdayjobs.com/Careers/job/GBEpsomWoodcote-Grove/SOC-L3-Analyst_R-167004-1 ## About the Role * Demonstrable experience within a 24x7 Security Operations Centre (SOC) or Incident Response environment, ideally supporting a global organisation. * Proven track record of improving threat detection, monitoring, incident response, and SOC operational maturity at scale. * Strong hands-on experience with SIEM platforms, threat intelligence solutions, security orchestration and automation (SOAR), and enterprise security monitoring technologies. * Good understanding of networking and Internet protocols, together with broad knowledge across multiple security domains and technologies. * Strong analytical, problem-solving, and communication skills, with the ability to engage effectively with both technical and non-technical stakeholders. * Demonstrates integrity, accountability, curiosity, adaptability, and a commitment to continuous learning and professional development., * Relevant industry certifications (e.g., CISSP, GCIH, GCFA, GCIA, Security+, Azure Security, or equivalent) would be a plus. * Incident Management, Curiosity, Critical thinking, Problem-solving, Technical Writing, Continuous improvement, Communication, Mentoring/Coaching. * Advanced threat investigation, Threat actor TTP analysis (MITRE ATT&CK), Threat Hunting. Desirable * Agentic AI. * Malware analysis. * Digital forensics and evidence preservation. ## Description The SOC Level 3 (L3) Analyst is responsible for leading the investigation, coordination and resolution of complex security incidents. Acting as a senior technical specialist, the role provides expert guidance on threat detection, incident response, and security operations while supporting the development of SOC capabilities and team expertise. The L3 Analyst maintains high standards of documentation and produces clear, concise communications tailored to both technical and non-technical stakeholders. During major security incidents, the role serves as the Incident Commander and primary point of contact, ensuring effective coordination, stakeholder engagement, and timely decision-making. In addition to operational responsibilities, the L3 Analyst contributes to the continuous improvement of SOC processes, use cases, and detection capabilities. The role requires strong automation and scripting skills to streamline repetitive tasks, enhance operational efficiency, and improve overall security outcomes. Reporting to the SOC Manager, the L3 Analyst is expected to demonstrate a deep understanding of emerging cyber security threats, technologies, and industry's best practices. The role contributes to the organization's cyber security strategy, roadmap, and continuous improvement initiatives, helping to ensure that security operations remain effective, resilient, and aligned with business objectives. Your role * Lead complex and high-severity cyber security investigations and incident response activities within a 24x7 Security Operations Centre (SOC), acting as a senior technical escalation point, taking ownership of investigations, and driving incidents through containment, eradication, recovery, and closure. * Act as Technical Incident Lead or Incident Commander, as appropriate, during major cyber security incidents, coordinating technical response activities, assessing risk, making informed decisions in ambiguous situations, and communicating effectively with technical teams, leadership, and business stakeholders. * Conduct proactive threat hunting, advanced investigations, and forensic triage across endpoint, network, cloud, identity, and other enterprise environments to identify malicious activity, attacker persistence, and previously undetected compromise, while ensuring appropriate preservation and handling of investigative evidence. * Analyze adversary tactics, techniques, and procedures (TTPs), threat intelligence, emerging threats, vulnerabilities, and investigation findings to develop hunting hypotheses, identify detection gaps, and continuously strengthen the organization's defensive capabilities. * Develop, tune, test, and continuously improve security detections, analytics, use cases, investigation methodologies, playbooks, and response procedures, including validating detection coverage against realistic adversary behaviors and the MITRE ATT&CK framework. * Drive automation and orchestration across security operations, using security queries, scripting, and automation to analyze data, accelerate investigations, reduce repetitive manual activities, and improve the consistency and effectiveness of response. * Lead incident response exercises, tabletop scenarios, post-incident reviews, and continuous-improvement activities, translating lessons learned into measurable improvements to SOC processes, controls, detection capabilities, operational readiness, and cyber resilience. * Collaborate with Security Engineering, Threat Intelligence, Vulnerability Management, Digital Forensics, IT, cloud and identity teams, and other stakeholders, while mentoring SOC analysts, producing high-quality technical and executive communications, supporting SOC metrics and SLAs, and participating in on-call/out-of-hours response for major incidents when required. A typical day * Incident investigation and response. * Detection engineering and continuous improvement. * Threat hunting. * Security projects, Automation and security engineering. * Mentoring and technical leadership.