Senior SOC Analyst in Pocklington

We’re now looking for a Senior SOC Analyst to take a leading role in complex incident response cases, guiding clients through high-severity security events and strengthening our overall SOC capability.

Responsibilities

• Incident response & forensics: You’ll lead major security incidents from detection through remediation, coordinating containment, analysing attacker activity, and supporting clients through critical decision-making.
• Threat hunting & detection engineering: You’ll proactively hunt for threats using advanced KQL analytics, enhance SIEM/EDR detections, tune rules, and develop signatures aligned to MITRE ATT&CK.
• Malware analysis & reverse engineering: You’ll perform malware triage and behavioural analysis, using reverse-engineering tools when needed to support investigations and strengthen detection coverage.
• Reporting & client communication: You’ll produce clear, high-quality investigation reports, timelines, and intelligence summaries that translate technical findings for a range of audiences.
• SOC leadership & continuous improvement: You’ll contribute to SOC playbooks, mentor junior analysts, support onboarding of new customers, and help evolve SOC processes and tooling.
• On-call support: You’ll participate in the 24×7 on-call rota to provide expert support during critical incidents.

What we’re looking for

• A strong background in DFIR, SOC operations, or incident response
• Ability to lead complex investigations and high-severity security incidents
• Confident decision-maker who can guide clients through critical situations
• Strong communicator, able to translate technical findings for any audience
• Collaborative mindset with willingness to work closely across teams
• Ability to mentor junior analysts and support skill development
• Comfortable working in fast-paced, high-pressure environments
• Proactive approach to improving SOC processes, playbooks, and detection capabilities

Key Skills

• Advanced SIEM expertise (ideally Microsoft Sentinel & Defender XDR)
• Strong DFIR/SOC/incident response experience
• High-level KQL capability
• Python/PowerShell for automation
• Core digital forensics skills
• Experience with Velociraptor, KAPE & sandbox tools
• Solid detection engineering understanding
• Strong technical reporting and documentation skills

Practical stuff

• Where is the role based? This role can be fully remote apart from an initial onboarding week on-site in Pocklington.
• What are the shift patterns? 9:00am until 5:00pm (Flexible start & finish) with on call responsibilities.
• What about security clearance? You will need to have lived in the UK continuously for at least 5 years and have no criminal record to achieve the clearance you need for this role. You must also already have/have the ability to obtain NPPV3.

If you’re still reading, we think there’s a strong chance you might be our kind of person. We believe a diversity of perspectives and experiences makes a team stronger — and the stronger our team, the more successful we will be.