Security Monitoring & SIEM Analyst

Salary: £45,000 - 60,000 per year

Requirements

• Strong knowledge of SIEM platforms such as Microsoft Sentinel, Splunk, or Elastic.
• Experience writing and tuning queries using Kusto Query Language (KQL), ES|QL or Kibana Query Language, and Splunk SPL.
• Understanding of event correlation, alerting, and detection use‑case development.
• Strong knowledge of Linux and Windows operating systems.
• Strong knowledge of core networking concepts, including TCP/IP, DNS, HTTP/S, firewalls, and VPNs.
• Experience analysing logs across endpoint, identity, network, and cloud environments.
• Strong knowledge of EDR/XDR concepts and workflows.
• Knowledge of IDS/IPS technologies and signature‑based detection.
• Experience working with tools such as Microsoft Defender, CrowdStrike, SentinelOne, or similar.
• Understanding of attacker Tactics, Techniques and Procedures (TTPs) and how they appear in logs and telemetry.
• Familiarity with the MITRE ATT&CK framework.
• Evidence of staying up to date with emerging threats, adversary tradecraft, and defensive techniques.
• Experience handling security incidents through detection and triage, investigation and analysis, and handover to Incident Response teams.
• Strong understanding of incident management processes.
• Knowledge of host‑based forensic concepts.
• Ability to apply post‑incident review learnings to improve detection and response.
• Preferred experience within a SOC or cyber defence environment.
• Preferred exposure to threat hunting or detection engineering.
• Preferred experience in high‑security or regulated environments.
• Preferred relevant cyber security certifications such as Microsoft SC‑200, GIAC/SANS, CREST, or other recognised qualifications.
• UK nationality and either current SC clearance or eligibility for SC clearance.

Responsibilities

• Monitor, analyse, and investigate security alerts across SIEM and security tooling.
• Conduct detailed investigations across log, endpoint, identity, and network telemetry.
• Develop and optimise detection logic and SIEM queries to improve alert fidelity.
• Analyse security events and correlate activity across multiple data sources.
• Support incident response activities, including containment, escalation, and remediation.
• Perform IOC analysis, enrichment, and validation using threat intelligence sources.
• Identify gaps in detection capabilities and contribute to continuous improvement.
• Work closely with infrastructure, SOC, and incident response teams to enhance response capability.
• Produce clear and structured investigation reports and escalation summaries.

Technologies

• Cloud
• HTTP
• Support
• Kibana
• Linux
• Network Security
• Splunk
• TCP/IP
• Windows

We are a global technology organisation with a well‑established cyber security capability supporting mission‑critical environments. Cyber security is central to our strategy, and we continue to invest in tooling, threat intelligence, and specialist talent. Our security function operates at a mature level, combining Security Operations, threat detection, incident response, and continuous improvement practices to defend against evolving threats. This is an onsite role based in Berkshire, offering a salary of £45,000 to £60,000 plus excellent benefits and training. We provide strong investment in professional development, certifications, and progression, with opportunities to grow into Senior SIEM Analyst, Detection Engineer, or Threat Hunter roles.