Job Description
Overview
The SOC Level 3 (L3) Analyst is responsible for leading the investigation, coordination and resolution of complex security incidents. Acting as a senior technical specialist, the role provides expert guidance on threat detection, incident response, and security operations while supporting the development of SOC capabilities and team expertise.
The L3 Analyst maintains high standards of documentation and produces clear, concise communications tailored to both technical and non-technical stakeholders. During major security incidents, the role serves as the Incident Commander and primary point of contact, ensuring effective coordination, stakeholder engagement, and timely decision-making.
In addition to operational responsibilities, the L3 Analyst contributes to the continuous improvement of SOC processes, use cases, and detection capabilities. The role requires strong automation and scripting skills to streamline repetitive tasks, enhance operational efficiency, and improve overall security outcomes.
Reporting to the SOC Manager, the L3 Analyst is expected to demonstrate a deep understanding of emerging cyber security threats, technologies, and industry's best practices. The role contributes to the organization's cyber security strategy, roadmap, and continuous improvement initiatives, helping to ensure that security operations remain effective, resilient, and aligned with business objectives.
Your role
Lead complex and high-severity cyber security investigations and incident response activities within a 24x7 Security Operations Centre (SOC), acting as a senior technical escalation point, taking ownership of investigations, and driving incidents through containment, eradication, recovery, and closure.
Act as Technical Incident Lead or Incident Commander, as appropriate, during major cyber security incidents, coordinating technical response activities, assessing risk, making informed decisions in ambiguous situations, and communicating effectively with technical teams, leadership, and business stakeholders.
Conduct proactive threat hunting, advanced investigations, and forensic triage across endpoint, network, cloud, identity, and other enterprise environments to identify malicious activity, attacker persistence, and previously undetected compromise, while ensuring appropriate preservation and handling of investigative evidence.
Analyse adversary tactics, techniques, and procedures (TTPs), threat intelligence, emerging threats, vulnerabilities, and investigation findings to develop hunting hypotheses, identify detection gaps, and continuously strengthen the organization's defensive capabilities.
Develop, tune, test, and continuously improve security detections, analytics, use cases, investigation methodologies, playbooks, and response procedures, including validating detection coverage against realistic adversary behaviours and the MITRE ATT&CK framework.
Drive automation and orchestration across security operations, using security queries, scripting, and automation to analyse data, accelerate investigations, reduce repetitive manual activities, and improve the consistency and effectiveness of response.
Lead incident response exercises, tabletop scenarios, post-incident reviews, and continuous-improvement activities, translating lessons learned into measurable improvements to SOC processes, controls, detection capabilities, operational readiness, and cyber resilience.
Collaborate with Security Engineering, Threat Intelligence, Vulnerability Management, Digital Forensics, IT, cloud and identity teams, and other stakeholders, while mentoring SOC analysts, producing high-quality technical and executive communications, supporting SOC metrics and SLAs, and participating in on-call/out-of-hours response for major incidents when required.
A typical day
- Incident investigation and response.
- Detection engineering and continuous improvement.
- Threat hunting.
- Security projects, Automation and security engineering.
- Mentoring and technical leadership.
About you
Demonstrable experience within a 24x7 Security Operations Centre (SOC) or Incident Response environment, ideally supporting a global organisation.
Proven track record of improving threat detection, monitoring, incident response, and SOC operational maturity at scale.
Strong hands-on experience with SIEM platforms, threat intelligence solutions, security orchestration and automation (SOAR), and enterprise security monitoring technologies.
Good understanding of networking and Internet protocols, together with broad knowledge across multiple security domains and technologies.
Strong analytical, problem-solving, and communication skills, with the ability to engage effectively with both technical and non-technical stakeholders.
Demonstrates integrity, accountability, curiosity, adaptability, and a commitment to continuous learning and professional development.
Required skills
Relevant industry certifications (e.g., CISSP, GCIH, GCFA, GCIA, Se
#J-18808-Ljbffr
SOC L3 Analyst in Epsom employer: Candu Energy
AtkinsRéalis is an exceptional employer that fosters a transformative and collaborative work culture, particularly for the Senior Advisor, Marketing Communications role within the nuclear sector. Employees benefit from competitive salaries, tailored rewards, and extensive professional development opportunities, all while enjoying a hybrid working environment that promotes work-life balance. With a commitment to inclusivity and belonging, AtkinsRéalis empowers its team members to thrive and contribute meaningfully to global projects that aim to engineer a better future.
