Tech lead - SOC responder in Whitehall

Managing incidents end to end, delivering clear and effective stakeholder communication, and mentoring other members of the SOC team.

Key responsibilities

• Support SOC Manager to deliver SIEM, IR tools platform management including all design, implementation, and administration activities.
• Prepare and implement use cases, deploy connectors, and maintain health checks.
• Responsible for operational activities, technology escalation support, security solution assessment, and maturing existing services.
• Analyse potential infrastructure security incidents to determine if incident qualifies as a legitimate security breach.
• Establish and govern security incident response processes, investigations and security operational processes.
• Maintain and enhance the formal service catalogue, service descriptions, targets, and performance.
• Ensure security services, tools and platforms are adequately maintained.
• Monitor and report on the effectiveness of security‑enforcing technologies.
• Identify and monitor specific security risks and KPIs, producing management information to ensure value from security investments/services.
• Contribute to design, development and maintenance of security standards and controls.
• Align team goals and plan with Colt's long‑term priorities and strategy.
• Develop and grow talent and people capability within the security teams.
• Own performance against expectations and deliver results.
• Proactively request leadership input, using feedback to improve personal performance.
• Review working methods and recommend improvements, owning delivery of action plans.
• Use cultural understanding to build rapport across teams for cooperation.

Qualifications

• Information Security Incident Response experience with a focus on detection and response to malicious activity using log data from various sources.
• Strong networking and systems experience, preferably in an enterprise environment.
• Strong understanding of information security and the threat landscape surrounding enterprise systems.
• Strong scripting experience (Python, PowerShell, Unix shell).
• Experience working in all phases of the SDLC.
• Deep understanding and experience using cyber security operations, security monitoring, endpoint (EDR), network, and SIEM tools.
• Prior SOC experience is a plus.
• Extensive knowledge of network and server security protocols, technologies, and products.
• Industry recognised certifications (CISSP, GCIH, GCFA, OSCP, etc.) preferred.
• Strong oral and written communication skills.
• Relentless curiosity and attention to detail.
• Ability to learn quickly and leverage prior experiences to solve current security challenges.
• Refusal to accept the status quo.
• Degree in Information Technology, Engineering or similar.
• SIEM management experience – desirable to have advanced certification from SIEM vendors such as ArcSight, MS Sentinel or LogRhythm.

Benefits

• Flexible working hours and option to work from home.
• Extensive induction program with experienced mentors and buddies.
• Opportunities for further development and educational opportunities.
• Global family leave policy.
• Employee assistance program.
• Internal inclusion & diversity employee networks.

We welcome people with diverse backgrounds and experiences and are committed to providing equal employment opportunities irrespective of gender identity or expression, sexual orientation, race, religion, disability, neurodiversity, age, marital status, pregnancy status, or place of birth.