SOC Shift Lead in England

Sopra Steria’s SOC is currently seeking SOC Shift Leads to join our Managed Security Service Provider team. This is a great opportunity to take on increased responsibility in a complex, fast-paced environment, leading, mentoring, and developing a team of SOC Analysts. As we expand our Cyber Security Operations capability, we’re looking for a Lead SOC Analyst to help protect multiple critical client environments. The role offers real variety and continued hands‑on involvement, combining leadership with incident response, threat detection, and operational delivery.

You will lead a team of analysts within a 24/7 SOC, acting as the primary escalation point for complex incidents, supporting operational delivery, and helping to mature our detection and response capabilities across multiple clients. This role is site‑based in Hemel Hempstead and follows a shift pattern of two day shifts (6am–6pm), two night shifts (6pm–6am), followed by four days off.

What you’ll be doing:

• Lead and mentor a team of SOC Analysts, providing technical guidance and operational oversight during shifts.
• Act as the primary escalation point for high‑severity security incidents.
• Monitor, triage, and investigate host‑ and network‑based security alerts across critical client infrastructure.
• Conduct in‑depth analysis of logs, alerts, and network traffic to identify malicious activity.
• Contribute to the development and improvement of detection rules and use cases aligned to the MITRE ATT&CK framework.
• Support continuous improvement of SOC processes, tooling, and incident response playbooks.
• Maintain clear and accurate incident documentation, including reports and post‑incident reviews.
• Represent the SOC in operational meetings with internal teams, partners, and stakeholders.

What you will bring:

• Proven experience working in a Security Operations Centre (SOC) environment.
• Experience handling and escalating security incidents across enterprise environments.
• Strong understanding of network and host‑based attack techniques.
• Hands‑on experience with SIEM platforms, ideally Microsoft Sentinel or Splunk.
• Experience leading or mentoring analysts in an operational security environment.

It would be great if you had:

• Experience improving detection content or threat‑informed defense use cases.
• Familiarity with the MITRE ATT&CK framework.
• Scripting or automation experience (e.g. Python, PowerShell, Bash).
• Exposure to malware analysis or reverse engineering (not required for day‑to‑day work).
• Relevant certifications such as CREST Practitioner Intrusion Analyst, Blue Team Level 1, or similar.

If you are interested in this role but not sure if your skills and experience are exactly what we’re looking for, please do apply, we’d love to hear from you!

Employment Type: Permanent

Location: Hemel Hempstead

Security Clearance Level: Eligible for DV (Developed Vetting)

Internal Recruiter: Lee

Salary: Up to £75k + on‑call allowance

Benefits: 25 days annual leave with the choice to buy additional holiday days, health cash plan, life assurance, and pension.