SOC Lead – Security Operations Centre Lead

About the role

We are seeking an experienced Lead SOC Analyst to oversee Security Operations Centre (SOC) activities, lead incident response efforts, and mentor a team of analysts. The successful candidate will have strong expertise in cyber threat detection, incident investigation, and the Splunk Enterprise Security (ES) platform.

Key responsibilities

• Lead day-to-day SOC operations and provide technical guidance to SOC Analysts.
• Monitor, investigate, and respond to security incidents and alerts.
• Develop, optimise, and maintain Splunk Enterprise Security use cases, correlation searches, dashboards, and reports.
• Conduct threat hunting and advanced forensic investigations.
• Coordinate incident response activities and provide detailed post‑incident analysis.
• Collaborate with IT, security, and business stakeholders to improve security posture.
• Support SOC processes, playbooks, and continuous improvement initiatives.

Required profile

• Extensive experience working in a SOC, Cyber Security, or Incident Response role.
• Strong hands‑on experience with Splunk Enterprise Security.
• Experience leading security investigations and major incident response activities.
• Knowledge of MITRE ATT&CK, SIEM technologies, threat intelligence, and security best practices.
• Relevant certifications such as Splunk Certified Cybersecurity Defence Analyst, CISSP, GCIA, GCIH, or equivalent are desirable.

What we offer

• Flexible Working options.
• 25 days holiday plus bank holidays, with the option to buy up to 5 additional days.
• Medicash & Critical Illness Scheme.
• Pension, Life Assurance, and Share Save Scheme.
• Community & Volunteering programmes.
• Green Car Scheme and Cycle‑to‑work scheme.
• Special time off for major life events.
• Generous maternity and paternity leave and support for fertility treatments.