SOC Analyst in London

Methods is a £100M+ IT Services Consultancy who has partnered with a range of central government departments and agencies to transform the way the public sector operates in the UK. Established over 30 years ago and UK-based, we apply our skills in transformation, delivery, and collaboration from across the Methods Group, to create end-to-end business and technical solutions that are people-centred, safe, and designed for the future.

As a Level 2 SOC Analyst, you are the senior technical responder within the secure operations team, responsible for owning security incidents end-to-end using the Microsoft security platform. You will act as the escalation point for Level 1 analysts and as the technical lead during active incidents, conducting deep investigations across Microsoft Sentinel, Microsoft Defender XDR, and Entra ID to validate threats, contain attackers, and coordinate remediation.

Key responsibilities:

• Incident investigation & response (primary focus)

• Act as an escalation point for all security alerts raised by Level 1 analysts.
• Validate incidents and determine severity, scope, root cause, and business impact.
• Lead technical investigations using Microsoft Sentinel, Microsoft Defender XDR, and Entra ID sign-in and audit logs.
• Correlate identity, endpoint, email, and cloud activity to reconstruct attack chains and timelines.
• Own incidents through identification, containment, eradication coordination, recovery validation, and post-incident review and documentation.
• Execute or coordinate containment actions including device isolation, account disablement, revocation of tokens, and blocking malicious indicators.
• Produce high-quality incident records including evidence, actions taken, root cause analysis, and lessons learned.

• Serve as technical incident lead during major security events.
• Provide accurate, timely updates to IT, security leadership, and affected teams.
• Maintain clear case management, documentation, and shift handovers.
• Contribute to operational reporting.
• Participate in a business-hours operating model with an on-call rotation for out-of-hours incidents.
• Act as a trusted technical point of contact for SOC service discussions.

• Tune Sentinel analytics rules to reduce false positives and missed threats.
• Improve correlation logic, entity mapping, and severity scoring.
• Develop and maintain Sentinel investigation playbooks and incident response runbooks.
• Build and refine SOAR workflows using Logic Apps.
• Perform quality assurance on Level 1 investigations and provide structured coaching feedback.
• Identify gaps in detection coverage and propose practical improvements.

• Provide informal technical leadership to Level 1 analysts through mentoring and coaching.
• Set and reinforce expectations for investigative rigour and documentation quality.
• Work closely with various teams to support onboarding of new Microsoft data connectors and Defender features.

Requirements:

• Years of experience in a SOC or security operations role with ownership of complex investigations.
• Strong hands-on experience with Microsoft Sentinel, Microsoft Defender for Endpoint, and other Microsoft security tools.
• Solid understanding of Windows internals, identity-based attacks, and common attacker techniques.
• Confident writing technical incident reports and stakeholder updates.

Certifications (desirable):

• Microsoft SC-200 (Security Operations Analyst)
• CompTIA CySA+ / Security+
• GIAC certifications (GCIH, GCIA, GMON)

Working pattern:

• Monday to Friday, business hours
• Participation in a rotating on-call schedule for evenings/weekends to support major security incidents.

Benefits:

• Autonomy to develop and grow your skills and experience.
• Be part of exciting project work that is making a difference in society.
• A supportive and collaborative environment.
• Access to LinkedIn Learning and training.
• 24/7 confidential employee assistance programme.
• Flexible working options.
• 25 days of annual leave plus bank holidays.
• 2 paid days per year to volunteer.
• Pension scheme with employer contribution.
• Private Medical Insurance.
• Enhanced Maternity and Paternity Pay.