REQUIRED QUALIFICATIONS AND EXPERIENCE

• You may be required to hold or obtain UK Non-Police Personnel Vetting (NPPV) and/or a Security Check (SC) clearance as part of this role.
• A minimum of 4+ years of SOC operational experience, with demonstrated ability across security analysis, incident response, and working escalated cases.
• Proven leadership capability with experience line managing analysts, conducting performance reviews, and overseeing HR-related duties.
• Experience providing ticket quality assurance and training delivery.
• Familiarity with leading SIEM, endpoint and XDR security platforms, in multi-tenant MSSP environments.
• Willingness to obtain or hold relevant security certifications, such as SBT BTL2 and CREST CRIA.

TECHNICAL KNOWLEDGE

• Operating Systems – Proficient with Windows and Linux environments. Able to interpret logs (e.g. Sysmon, Event Viewer, Syslog), assess process behaviour, and identify privilege misuse.
• Endpoint Tools – Experience in endpoint detection and response across diverse customer environments, including alert triage, telemetry analysis, and supporting threat response.
• SIEM and Log Correlation – Able to perform detailed analysis within multi-tenant SIEM environments, interpreting data from diverse sources (including network, identity, and endpoint).
• Detection and Threat Hunting – Able to plan and execute threat hunting activities using ATT&CK-aligned techniques, drawing on all available telemetry to investigate anomalous activity and validate detection coverage across multiple customer environments.
• Networking Fundamentals - Understand core protocols (TCP/IP, DNS, HTTP), packet analysis, and log interpretation from firewalls, switches, and proxies.
• Incident Response Process - Familiar with the full incident response lifecycle and able to support investigation, containment, and recovery activities under defined playbooks.
• Threat Intelligence - Able to consume, interpret, and apply threat intelligence sources to enrich investigations and support proactive detection improvements.
• Automation and Scripting - Understand the principles of scripting (e.g. PowerShell, Python, Bash) to support investigation and automate analysis tasks.

ESSENTIAL ROLES & RESPONSIBILITIES

As a Senior SOC Analyst (Team Leader), you apply your advanced security operations expertise to lead a team of SOC Analysts while performing advanced investigations and, when required, first-line triage to maintain queue health and SLA compliance. You are responsible for high-quality service delivery through detailed analysis, evidence-led response actions, and operational leadership. In addition to handling escalated alerts, you provide line management, oversee ticket quality, contribute to training and onboarding, and drive continual improvement. You work core business hours with participation in the on-call rota, ensuring consistent service support for customers and operational continuity across teams.

KEY RESPONSIBILITIES

• Incident Investigation and Response – You take ownership of escalated incidents, performing detailed investigations and, when necessary, stepping into first-line triage to guarantee prompt alert handling and escalation.
• Team Leadership – You provide day-to-day leadership and line management for a team of SOC Analysts, conducting performance reviews, appraisals, one-to-one meetings, and development planning.
• Quality Assurance – You own QA for the team’s outputs, ensuring consistency, accuracy, and completeness of incident handling and documentation across the team.
• Training and Onboarding – You lead knowledge-transfer sessions, support structured onboarding of new team members, and coordinate internal training to drive skill development and reinforce SOC best practices.
• Continual Improvement – You identify opportunities to optimise workflows, enhance detection logic, and contribute to service-improvement initiatives across the SOC, including backlog reduction, knowledge-base expansion, and feedback loops from lessons learned.
• Customer Communications – You provide timely incident updates and lead bridging calls with customers during high-priority incidents, ensuring that communications are clear, evidence-led, and aligned to customer expectations.
• Threat Hunting Oversight – You lead and coordinate proactive threat hunting across customer environments, using hypothesis-based approaches to identify undetected threats and validate detection coverage.

ESSENTIAL DUTIES

• Advanced Investigation and Escalated Response
  o Perform in-depth investigations using correlated data from all available tooling.
  o Reconstruct attack chains and identify root causes using MITRE ATT&CK.

  o Recommend and coordinate response actions to mitigate impact during active incidents.

• IOC and Threat Analysis

  o Investigate indicators of compromise using commercial and open-source threat intelligence.

  o Validate alerts and determine their relevance to customer environments, providing context on adversary behaviour and recommending follow-up actions when threats are confirmed.

• Threat Hunting

  o Lead and participate in threat hunts using hypothesis-driven approaches mapped to TTPs and MITRE ATT&CK.
  o Leverage telemetry and queries in tooling to identify suspicious indicators not surfaced through existing detection logic.

  o Document hunting activities, findings, and detection coverage gaps to support tuning and continual detection improvement.

• Team Oversight

  o Provide feedback and coaching on triage techniques, escalation decisions, and ticket quality.
  o Monitor performance, manage formal HR processes, and support professional development through regular one-to-ones and quarterly appraisals.

  o Provide concise on-call handovers and status reporting to maintain continuity between core and shift teams, escalating risks or operational issues as needed.

• Documentation and Reporting

  o Ensure clear, evidence-based documentation of incidents and investigations, including rationale for response actions and IOC validation.
  o Perform case-closure quality assurance to confirm investigation completeness and capture lessons learned.
  o Support knowledge-base development and post-incident reporting activities, ensuring reusable insights are recorded to improve future incident handling and analyst onboarding.