Senior SOC Analyst - Detection Engineering (SC Cleared)

The following information provides an overview of the skills, qualities, and qualifications needed for this role.
Senior SOC Analyst - Detection Engineering (SC Cleared)
£450 per day | Outside IR35 | 9-Month Contract
Active SC Clearance Required | London (1 day per month onsite)

A leading consultancy is looking for a Senior SOC Analyst to join a high-profile cyber security programme supporting critical public sector services. This role offers a unique blend of detection engineering and SOC operations, providing the opportunity to develop and optimise advanced detection capabilities while helping protect large-scale cloud environments.

Working within a Security Operations Centre (SOC), you'll be responsible for building and tuning detections, investigating security incidents, and improving the effectiveness of security monitoring across AWS and Splunk environments.

The Role

As a Senior SOC Analyst, you will operate at the intersection of security operations, threat detection, and cloud security. You'll work closely with SOC analysts, engineers, and stakeholders to develop high-fidelity detections, reduce false positives, and strengthen overall security visibility.

This is an excellent opportunity for someone with Splunk and AWS security monitoring experience who enjoys both hands-on threat analysis and detection development.

Key Responsibilities
Detection Engineering

• Develop, test, and optimise Splunk SPL correlation searches and alerting logic.
• Create and maintain detection use cases aligned to attacker tactics, techniques, and procedures (TTPs).
• Build AWS-focused detections leveraging CloudTrail, GuardDuty, IAM activity, and VPC Flow Logs.
• Tune and enhance detection content to improve alert accuracy and reduce false positives.
• Develop signatures and detections using Sigma, YARA, and IDS-based rules where appropriate.
• Map detection coverage against the MITRE ATT&CK framework.

SOC Operations

• Monitor and triage security alerts within Splunk SIEM.
• Investigate security incidents including phishing attacks, credential abuse, malicious process activity, and suspicious network traffic.
• Support incident response activities through containment and escalation procedures.
• Maintain detailed security case documentation and investigation notes.
• Contribute towards operational metrics including MTTD and MTTR targets.

Essential Skills & Experience

• Active SC Clearance (required).
• 1-3 years' experience within a SOC Analyst, Security Analyst, Detection Engineer, or Security Operations role.
• Strong hands-on experience with Splunk and SPL query development. xgikmsk
• Experience building, tuning, and maintaining SIEM detection rules.
• AWS security monitoring experience including:
  • CloudTrail
  • GuardDuty
  • IAM
  • VPC Flo Please click on the apply button to read the full job description