Microsoft Security Analyst in Birmingham

Role PurposeWorking as a key member of our SOC 24x7 shift team, you will use your expertise to detect and respond to a multitude of threats of differing capability and sophistication. You will use SIEM, EDR, Network Monitoring, bespoke tooling and Threat Intelligence solutions to triage suspicious events, provide context and an assessment of risk/threat to customers to enable efficient response and continuously monitor customer environments; Not only will you be expected to assess threats using all information sources available to you, but you’ll also get involved in projects that enhance the capability of our services and ensure we are providing cutting-edge detection & response services to our clients. This includes threat hunting, supporting the implementation of new cutting-edge technology, malware analysis, recommending detections and getting involved in strategic cross-team projects as part of your wider role within our award-winning Security Operations Centre. We’re a high-trust, close-knit team that doesn’t operate under the traditional SOC tiers, so the passion and drive to get involved, make a difference and use your eye for detail to spot patterns and support both our security mission and that of our customers is essential. Key Role ResponsibilitiesThe following list is indicative of the overall expectations of the role (not exhaustive): Operate as part of the 24x7 SOC Monitor Team, providing proactive defensive monitoring to clients of all shapes, sizes and industries.Maintain an awareness of the latest Defensive Monitoring technologies and trends.Produce high quality management and operational reports within agreed SLAs.Experience with Microsoft Sentinel and Microsoft Defender (Defender for Endpoint, Defender for Identity, Defender for Cloud Apps), including deployment, configuration, and day-to-day operational management within an enterprise environment.Knowledge of SIEM and EDR/EPP technologies, with a particular focus on leveraging Microsoft Sentinel and Defender to deliver threat detection, investigation, and response capabilities.Proven ability to operate within a complex, high-performing service management enterprise environment, using Microsoft’s security tools to enhance visibility, resilience, and incident response effectiveness.Experience in conducting security investigations using large datasets, with knowledge of Kusto Query Language (KQL) to develop custom Sentinel queries and analytics rules.Solid understanding of enterprise IT infrastructure, including Windows and Linux operating systems, networking, and third-party security tools — and how these integrate with the Microsoft security ecosystem.Experience of analysing complex security data within Sentinel and Defender portals, identifying patterns, prioritising threats, and presenting actionable recommendations.Excellent communication skills, with experience in customer-facing roles and the ability to clearly convey technical findings and security risk to both technical and non-technical stakeholders, using Microsoft dashboards and reporting tools.DesirableMicrosoft certifications such as SC-200 and SC-100Crowdstrike certifications such as CCFA, CCSAPython, PowerShell, and RegEx skillsKey Performance IndicatorsKey Performance Indicators (KPIs) are goals that must be achieved in order to demonstrate satisfactory or above performance for this job role. KPIs will be monitored on an on-going basis throughout each year and will be explored in further depth as part of the performance management process.Triage and action all security alerts and customer requests within established SLAsMaintain documentation of processes, investigations, and use-casesComplete all management reporting, projects, and any other assigned workDevelop the Security Engineering technology stack through upgrades and automation.Adhere to Analyst Best Practice, Core Competencies, Compliance and Process/Procedure StandardsAdhere to LRQA Policies and Procedures, as detailed in the HR ‘UK Employee Handbook’ and ‘Policies & Procedures’ sections of the LRQA Intranet