Microsoft Security Operations Centre (SOC) Analyst - T2 & T3 in Manchester

The SOC Analyst Team operates as a next generation, intelligence led Security Operations function, designed to deliver high quality, scalable 24×7 security monitoring and response. All SOC analysts participate in a 24×7 shift model, ensuring uninterrupted service coverage, while also contributing to detection improvement, automation feedback, and service optimisation when operational demand allows.

Tier 2 - SOC Analyst Technology Primary - Microsoft Sentinel & Service Now. Tier 2 SOC Analysts represent the primary human analysis function, responsible for investigating escalated alerts and incidents that require human judgement, contextual understanding, and analytical depth.

• Perform deep investigation of escalated alerts and incidents from automated Tier 1 workflows
• Validate threats, scope impact, and determine severity using contextual analysis
• Investigate across multiple data sources, including:
• SIEM
• EDR / XDR
• Identity and authentication telemetry
• Cloud and SaaS platforms
• Coordinate and execute response actions in line with:
• Defined playbooks
• Client specific requirements
• Incident response procedures
• Maintain clear, high quality investigation documentation and handover notes
• Operate as part of a 24×7 shift rota
• Maintain accountability for investigation accuracy and quality
• Escalate complex or ambiguous cases to Tier 3 appropriately
• Provide structured feedback into:
• Detection tuning
• Alert quality improvements
• Automation optimisation
• Contribute to platform improvement activities when operational demand allows, supporting the Platform Automation Lead through:
• Identification of repeatable investigation patterns
• Feedback on automation opportunities
• Playbook refinement and improvement
• Detection logic tuning recommendations

Tier 3 analysts provide advanced security expertise and escalation handling, focusing on complex, high risk, or ambiguous security incidents and ensuring consistent investigation quality across the SOC.

• High impact or business critical incidents
• Advanced or evasive attacker techniques
• Ambiguous or novel threat behaviour

• Attacker behaviour and intent assessment
• Cross incident correlation
• Campaign and intrusion analysis

• Lead complex incident response coordination where required

• Participate in 24×7 escalation coverage, via on call or senior shift roles
• Act as a technical mentor to Tier 2 analysts
• Support analyst development through coaching and investigative guidance
• Set investigation and response quality standards across the SOC

• Like Tier 2, Tier 3 analysts are expected to provide structured feedback into platform and automation initiatives, working indirectly with the Platform Automation Lead to:
• Improve detection fidelity
• Assist in detection and alert quality improvements

Qualifications & Expectations: The original description emphasizes experience in security operations, incident response, threat analysis, and cross-functional collaboration, with a focus on Tier 2 and Tier 3 analysts and platform automation. Applicants should demonstrate ability to work in a 24×7 environment and contribute to improvements in detection, automation, and playbooks.