SOC Analyst in Richmond

About Us

Inforcer is one of the fastest growing technology organisations in the world and a leading provider of cutting-edge cybersecurity and AI solutions to support the SMB market. We provide MSPs (Managed Service Providers) with the fundamental technology they need to manage and secure Microsoft 365 at scale and deliver AI services. Our mission is to be enforced in every MSP!

About the Role

We are seeking a SOC Analyst to play a critical role in monitoring, investigating, and responding to security threats across our environment. There are two key parts to the role.

• Firstly, you will act as the front line of our security operations; reviewing alerts, identifying suspicious activity, and conducting hands-on investigations using our SIEM, EDR, and threat intelligence tools. This is an operational role with real ownership, ideal for someone who thrives in a fast-paced environment, enjoys digging into logs, and can bring clarity to complex behaviours across our network, endpoints, and cloud platforms. As part of this, you will take part in regular out-of-hours work, which is a natural component of a 24/7 security operation and compensated as overtime.
• Secondly, you will help strengthen our detection and response capabilities by improving playbooks, enhancing alert quality, and contributing insights that increase our overall readiness. As our environment grows, you’ll play a pivotal role in reducing noise, closing detection gaps, and ensuring incidents are handled quickly, consistently, and with high quality. Your work will directly support our ability to remain secure, resilient, and able to operate without interruption.

What you’ll be doing

• Monitor our In-house Custom tooling for real-time alerts and suspicious activity.
• Triage, investigate, and document security incidents following established playbooks.
• Perform in-depth log analysis across our customer estate.
• Escalate incidents as needed and collaborate with internal teams.
• Support containment and remediation efforts.
• Contribute to improving detection content by identifying gaps, false positives, and tuning opportunities.
• Participate in threat hunting exercises and proactive investigations into anomalous behaviour.
• Assist with onboarding and operationalising new security tools and processes.
• Stay current with emerging threats, attack techniques, and security best practices.

What We Can Offer You

• Steep Learning curve: We believe people leave organisations when learning stops. We promise a steep and continuous learning curve to both challenge and develop our people. You are responsible for your own learning, but you’ll be surrounded by exceptional people and strong enablement, if you choose to lean into it, in an environment where it’s safe to make mistakes, try new things, and improve.
• Real impact: We operate in a high-trust and autonomous environment where you can make a real impact and difference in your role and across the company.
• Transparency and Honesty: We believe honest and clear communication creates a highly collaborative culture. It gives you the “why” we make decisions and allows you to effectively make your own. We won’t pull the wool over your eyes, we are a fast-growing start-up that comes with its own unique challenges, but we all work hard to solve them, together, as a team.
• A+ Global Team: Our people power every part of our business, and we look for individuals who bring genuine passion to their role and operate at their very best. A-players thrive when surrounded by other A-players. Our level of growth and rate of change can be hard work and challenging, but you’ll be surrounded with exceptional people that are always happy to help.
• Regular Team Socials: We celebrate our team, our milestones, promotions and achievements with social events every month.
• Employee Recognition: Programs to recognise and reward our top contributors for their achievements and efforts. We live our company values every day and reward those people who embody them.

Skills We Need for This Role

• Hands-on alert triage experience in a SOC, MSP, MSSP or internal security team.
• Working KQL, you can query sign-in, audit and hunting data to answer a question unaided.
• Strong Microsoft 365 and Entra ID security knowledge: authentication flows, conditional access, OAuth and app consent, mailbox and delegation permissions, and the audit trail behind each.
• Practical understanding of MITRE ATT&CK and identity-led attack techniques against Microsoft 365.
• Sound judgement on when evidence supports a conclusion, and the confidence to say when it does not.
• Clear, concise written English for a technical audience, under time pressure.

Inforcer is an equal opportunity employer. We celebrate diversity and are committed to creating an inclusive environment for all employees.