SOC L3 Analyst in Epsom

The SOC Level 3 (L3) Analyst is responsible for leading the investigation, coordination and resolution of complex security incidents. Acting as a senior technical specialist, the role provides expert guidance on threat detection, incident response, and security operations while supporting the development of SOC capabilities and team expertise.

The L3 Analyst maintains high standards of documentation and produces clear, concise communications tailored to both technical and non-technical stakeholders. During major security incidents, the role serves as the Incident Commander and primary point of contact, ensuring effective coordination, stakeholder engagement, and timely decision-making.

In addition to operational responsibilities, the L3 Analyst contributes to the continuous improvement of SOC processes, use cases, and detection capabilities. The role requires strong automation and scripting skills to streamline repetitive tasks, enhance operational efficiency, and improve overall security outcomes.

Reporting to the SOC Manager, the L3 Analyst is expected to demonstrate a deep understanding of emerging cyber security threats, technologies, and industry’s best practices. The role contributes to the organization’s cyber security strategy, roadmap, and continuous improvement initiatives, helping to ensure that security operations remain effective, resilient, and aligned with business objectives.

Your role

• Lead complex and high-severity cyber security investigations and incident response activities within a 24x7 Security Operations Centre (SOC), acting as a senior technical escalation point, taking ownership of investigations, and driving incidents through containment, eradication, recovery, and closure.
• Act as Technical Incident Lead or Incident Commander, as appropriate, during major cyber security incidents, coordinating technical response activities, assessing risk, making informed decisions in ambiguous situations, and communicating effectively with technical teams, leadership, and business stakeholders.
• Conduct proactive threat hunting, advanced investigations, and forensic triage across endpoint, network, cloud, identity, and other enterprise environments to identify malicious activity, attacker persistence, and previously undetected compromise, while ensuring appropriate preservation and handling of investigative evidence.
• Analyze adversary tactics, techniques, and procedures (TTPs), threat intelligence, emerging threats, vulnerabilities, and investigation findings to develop hunting hypotheses, identify detection gaps, and continuously strengthen the organization’s defensive capabilities.
• Develop, tune, test, and continuously improve security detections, analytics, use cases, investigation methodologies, playbooks, and response procedures, including validating detection coverage against realistic adversary behaviors and the MITRE ATT&CK framework.
• Drive automation and orchestration across security operations, using security queries, scripting, and automation to analyze data, accelerate investigations, reduce repetitive manual activities, and improve the consistency and effectiveness of response.
• Lead incident response exercises, tabletop scenarios, post-incident reviews, and continuous-improvement activities, translating lessons learned into measurable improvements to SOC processes, controls, detection capabilities, operational readiness, and cyber resilience.
• Collaborate with Security Engineering, Threat Intelligence, Vulnerability Management, Digital Forensics, IT, cloud and identity teams, and other stakeholders, while mentoring SOC analysts, producing high-quality technical and executive communications, supporting SOC metrics and SLAs, and participating in on-call/out-of-hours response for major incidents when required.

A typical day

• Incident investigation and response.
• Detection engineering and continuous improvement.
• Threat hunting.
• Security projects, Automation and security engineering.
• Mentoring and technical leadership.

About you

• Demonstrable experience within a 24x7 Security Operations Centre (SOC) or Incident Response environment, ideally supporting a global organisation.
• Proven track record of improving threat detection, monitoring, incident response, and SOC operational maturity at scale.
• Strong hands‑on experience with SIEM platforms, threat intelligence solutions, security orchestration and automation (SOAR), and enterprise security monitoring technologies.
• Good understanding of networking and Internet protocols, together with broad knowledge across multiple security domains and technologies.
• Strong analytical, problem‑solving, and communication skills, with the ability to engage effectively with both technical and non‑technical stakeholders.
• Demonstrates integrity, accountability, curiosity, adaptability, and a commitment to continuous learning and professional development.

Required skills

• Relevant industry certifications (e.g., CISSP, GCIH, GCFA, GCIA, Security+, Azure Security, or equivalent) would be a plus.
• Incident Management, Curiosity, Critical thinking, Problem‑solving, Technical Writing, Continuous improvement, Communication, Mentoring/Coaching.
• Advanced threat investigation, Threat actor TTP analysis (MITRE ATT&CK), Threat Hunting.

Desirable

• Agentic AI.
• Malware analysis.
• Digital forensics and evidence preservation.

Rewards & benefits

Explore the rewards and benefits that help you thrive – at every stage of your life and your career. Enjoy competitive salaries, employee rewards and a brilliant range of benefits you can tailor to suit your own health, wellbeing, financial and lifestyle choices. Make the most of a myriad of opportunities for training and professional development to grow your skills and expertise. And combine our hybrid working culture and flexible holiday allowances to balance a great job and fulfilling personal life.

About AtkinsRéalis

We’re AtkinsRéalis, a world‑class engineering services and nuclear organization. We connect people, data and technology to transform the world’s infrastructure and energy systems. Together, with our industry partners and clients, and our global team of consultants, designers, engineers and project managers, we can change the world. We’re committed to leading our clients across our various end markets to engineer a better future for our planet and its people.

Additional information

This role may require security clearance and offers of employment will be dependent on obtaining the relevant level of clearance. If this is necessary, it will be discussed with you at interview. The vetting process is delivered by United Kingdom Security Vetting (UKSV) and may require candidates to provide proof of residency in the UK of 5 years or longer.

We are committed to creating a culture where everyone feels that they belong - a place where we can all be ourselves, thrive and develop to be the best we can be. So, we offer a range of family friendly, inclusive employment policies, flexible working arrangements and employee resource groups to support all employees. As an Equal Opportunities Employer, we value applications from all backgrounds, cultures and ability. As a Disability Confident Leader, we are committed to offering an interview to all applicants who have a disability and meet the essential criteria. If you would like to be considered under this commitment, please let us know at the application stage.

At AtkinsRéalis, we seek to hire individuals with diverse characteristics, backgrounds and perspectives. We strongly believe that world‑class talent makes no distinctions based on gender, ethnic or national origin, sexual identity and orientation, age, religion or disability, but enriches itself through these differences.