Level 1 Security Operations Center Analyst (SOC)

About the role

We are looking for a Level 1 Security Operations Center Analyst to join a growing cyber‑security team supporting a major defence programme in the UK. You will be the first responder to security alerts, working closely with an outsourced SOC provider and internal stakeholders to investigate and triage potential threats.

Key responsibilities

• Triage and validate alerts received from the SOC provider.
• Conduct initial investigations using SIEM tools and log data.
• Engage with users and stakeholders to gather context and support containment actions.
• Escalate confirmed incidents with clear documentation.
• Maintain accurate case records, timelines, and evidence.
• Act as the liaison between internal security teams and the external SOC.
• Follow established playbooks and suggest improvements.

Required profile

• 2‑4 years of experience in a SOC, IT operations, or security support role.
• Understanding of common threats such as phishing, malware, and privilege escalation.
• Knowledge of networking fundamentals and system logs (Windows or Linux).
• Strong analytical and communication skills.
• Desirable: familiarity with MITRE ATT&CK, NIST or ISO 27001 frameworks; experience with MSSPs or outsourced SOC models; basic scripting skills; Security+ or CySA+ certification.

Required skills

• SIEM tools – Sentinel, Splunk, Elastic, QRadar.
• Scripting – PowerShell, Python, Bash.
• Windows and Linux log analysis.

What we offer

• Hands‑on incident response experience on enterprise‑scale operations.
• Exposure to modern tools, processes, and threat landscapes.
• Collaborative and supportive team environment.