SOC Operator - 24mth Contract -Active SC

Contract Length: 24 months
Location: Fully Remote (UK-based)
Clearance Required: Active SC Clearance
Engagement: Contract
Start: ASAP

Day Rates

• SFIA Level 4: Up to £500 per day
• SFIA Level 5: Up to £750 per day

Role Overview

We are seeking an experienced SOC Operator to support a public sector security operations capability, with a focus on threat detection, incident response, and collaboration with delivery teams to improve security monitoring and resilience.

The role involves developing detection content aligned to recognised threat frameworks, supporting incident investigations, and helping technical and non-technical stakeholders prepare for and respond to security incidents.

Key Responsibilities

• Develop and maintain SIEM rules and alerts in Splunk, mapped to the MITRE ATT&CK framework
• Analyse security events and alerts to identify potential threats and incidents
• Contribute to and lead incident response activities, including:
  • Incident investigation
  • Impact assessment
  • Remediation advice and follow-up actions
• Develop and maintain incident response playbooks and Business Continuity & Disaster Recovery (BCDR) plans
• Engage with non-technical stakeholders to ensure incident processes are clear, actionable, and understood
• Guide development and platform teams on:
  • Required log sources
  • Logging standards and quality
  • SIEM ingestion requirements
• Work collaboratively with engineers, architects, and security teams to improve detection coverage and operational resilience
• Support and contribute to threat hunting activities (prior experience desirable but not essential)

Essential Skills & Experience

• Proven experience working in a SOC, incident response, or cyber operations role
• Hands-on experience writing Splunk detection rules and alerts
• Strong understanding of the MITRE ATT&CK framework and threat-led detection approaches
• Practical experience in incident response, including:
  • Investigation and analysis
  • Stakeholder advisory
  • Remediation planning
• Ability to translate threats and incidents into clear guidance for technical and non-technical audiences
• Experience defining logging requirements for effective SIEM monitoring
• Strong written documentation skills (runbooks, playbooks, incident reports)
• Comfortable operating at SFIA Level 4 or Level 5, depending on experience and scope

Desirable Experience

• Prior threat hunting experience in enterprise or public sector environments
• Exposure to cloud-based logging and monitoring (e.g. AWS services)
• Experience supporting security operations in regulated or government settings

Security & Eligibility Requirements

• Active SC Clearance (mandatory)
• UK-based