SOC Analyst in London

We are seeking an experienced Incident Response Analyst to support the detection, triage, investigation, containment and resolution of cyber security incidents across a complex enterprise environment.

Key Responsibilities

• Monitor and investigate alerts from SIEM, EDR/XDR, identity, email, cloud and network security technologies.
• Triage incidents, assess severity and business impact, and coordinate containment, eradication and recovery.
• Investigate phishing, malware, account compromise, data loss, unauthorised access and suspicious network activity.
• Collect, preserve and analyse endpoint, server, identity, network, email and cloud artefacts.
• Analyse logs, packet captures, forensic images and security telemetry to establish scope, root cause and attacker activity.
• Identify IOCs, attacker behaviours, TTPs and map findings to MITRE ATT&CK where appropriate.
• Develop and execute threat hunts and contribute to detection rule, monitoring and logging improvements.
• Maintain incident records, investigation timelines, evidence and post-incident reports.
• Develop and maintain incident response playbooks, procedures and communication processes.
• Conduct post-incident reviews, root-cause analysis and lessons-learned activities.
• Provide clear technical and management updates to senior stakeholders.

Essential Skills & Experience

• Practical experience in cyber security incident response, security monitoring or a SOC environment.
• Hands-on experience with SIEM and EDR/XDR technologies.
• Experience investigating Windows and Linux systems, authentication activity, security logs and network traffic.
• Strong understanding of the incident response lifecycle.
• Knowledge of MITRE ATT&CK, Cyber Kill Chain and NIST.
• Good understanding of enterprise networking, IAM, cloud, email and endpoint security.
• Experience with digital forensics and evidence handling.
• Strong communication, investigation and analytical skills.

Desirable

• Banking, financial services or other regulated-sector experience.
• Microsoft Sentinel, Defender XDR, Defender for Identity or Defender for Cloud.
• KQL, PowerShell, Python or similar scripting/automation.
• Threat hunting, malware analysis and detection engineering.
• Azure and Microsoft 365 investigation experience.
• EnCase, FTK, Velociraptor, Volatility or Wireshark.
• Certifications such as GCIH, GCIA, GCFA, GNFA, SC-200, CySA+ or CISSP.

Qualifications

• Relevant cyber security experience, degree or equivalent practical experience.
• Knowledge of NIST, CIS Controls and recognised information security standards.