Associate SOC Analyst

As an Associate SOC Analyst, you bring a strong background in IT or cybersecurity to a transitory role that builds towards full SOC Analyst responsibilities. You use your foundational knowledge to independently triage, investigate, and validate alerts using established playbooks. While you handle basic incident investigations and documentation, you escalate cases requiring deeper analysis to Shift Leads or Senior SOC Analysts. This role focuses on developing your skills through mentoring, continuous learning, and hands-on experience, with the expectation of advancing to a full SOC Analyst position within 18 months following your successful probationary period.

Key Responsibilities

• Incident Triage and Investigation - You review and prioritise new alerts from security monitoring tools (e.g., SIEM, endpoint solutions), performing basic checks to distinguish genuine threats from false positives. You rely on established playbooks and make initial validation decisions while escalating more complex incidents to Shift Leads or Senior SOC Analysts.
• Continuous Improvement - You contribute to the enhancement of detection logic by identifying recurring or redundant alerts. You participate in threat hunting and skills development sessions to help reduce false positives and accelerate response times.
• Escalation - You ensure that incidents requiring advanced investigation or containment are properly escalated. Your clear, concise documentation, including detailed ticket notes and supporting evidence, facilitates smooth handovers to Shift Leads, Senior SOC Analysts, or customer teams.

Essential Duties

• Alert Validation - Combine data from SIEM platforms, endpoint solutions, and other security tools to develop a comprehensive view of alerts. Document your findings using clear, evidence-based reasoning to determine if further investigation is warranted.
• Indicator of Compromise (IOC) Analysis - Validate suspected IOCs using documented procedures to identify legitimate threats or false positives. Request guidance from Shift Leads or Senior SOC Analysts when advanced techniques are required.
• Reporting and Documentation - Maintain accurate records in ticketing systems, ensuring each alert has a clear summary and documented conclusion. Contribute data to security reviews by highlighting trends and recurring issues.
• Continuous Improvement - Actively engage in training, self-study, and hands-on exercises to remain updated on emerging cybersecurity threats and best practices. Share newly acquired knowledge and techniques with your team to foster a collaborative learning environment.

Position Specifications - Required Qualifications and Experience

• You must hold, or be eligible to hold, Security Check (SC) clearance in the UK.
• A strong foundational background in IT or cybersecurity.
• Demonstrated ability to perform basic incident triage, analysis, and escalation; extensive hands-on SOC operational experience is not required, as this role serves as a stepping stone to a full SOC Analyst.
• Willingness to work toward or obtain entry-level cybersecurity certifications (e.g. CompTIA Security+, Security Blue Team BTL1).
• Familiarity with SIEM platforms, firewalls, endpoint solutions and ticketing systems.
• A proactive approach to learning and the ability to work both independently and collaboratively.

Technical Knowledge

• Basic Operating Systems - Understand fundamental Windows architecture (navigation of Control Panel, basic Active Directory functions, reading Windows Event Logs) and introductory Linux commands (basic shell navigation, file management).
• Foundational Networking - Know core concepts of TCP/IP, DNS, DHCP, simple router/switch operations, and basic firewall configuration principles.
• Cybersecurity Essentials - Grasp the CIA triad, common attack methods (phishing, malware, and social engineering), and basic risk assessment and security best practices.
• Introductory Threat Frameworks - Have a high-level awareness of the MITRE ATT&CK framework and Cyber Kill Chain, understanding these as context for attacker behaviour.