SOC Shift Lead in City of Westminster

Responsibilities

• Investigate escalated incidents to determine attack vectors, scope, and potential impact.
• Correlate events across multiple data sources to build a comprehensive incident narrative.
• Execute containment, eradication, and recovery activities in coordination with IT/OT stakeholders.
• Lead response for medium to high-severity incidents and document detailed investigation reports.
• Conduct tuning of detection rules and thresholds in collaboration with the Security Content Engineer.
• Support continuous improvement by identifying gaps in detection coverage and playbooks.
• Mentor and provide technical guidance to L1 Analysts.
• Participate in periodic SOC exercises and simulated incident response drills.
• Be part of a 24/7 SOC Team and work in shifts.
• As a shift lead, be responsible for handling escalations of the Technology Operations Centre in that shift.
• Be accountable in the absence of a SOC manager or NOC lead.

Qualifications

• Education: Bachelor's degree in Cybersecurity, Computer Science, or related field.
• Experience: 7-10 years in SOC, Incident Response, or Threat Analysis roles.
• Certifications (preferred): GCIA, GCIH, Comp TIA Cy SA+, Microsoft SC-200, or Splunk Certified Power User.
• Skills: Strong analytical mindset, in-depth knowledge of SIEM/EDR tools, malware behaviour, and incident handling methodologies.
• #J-18808-Ljbffr