Senior SOC Analyst

Senior SOC Analyst / Incident Response Specialist, on-site in Central London, starting ASAP. Start ASAP Duration Initially until end of March 2027 Location 100% on-site at the client's SOC, Central London Shift pattern 4 days x 10-hour shifts About the role The client needs a senior analyst who can hit the ground running and help lift the SOC's caseload. The focus is operational: day-to-day threat detection, triage, investigation and incident response, including answering tickets, rather than engineering or project implementation. The SOC runs on Splunk and is implementing an agentic AI SOC platform. As needed, you will also contribute to detection engineering, threat hunting and proactive investigations. Responsibilities

• Drive technical response actions to protect the organisation and its global users from fast-moving and AI-driven threats.
• Develop and tune alerts to quickly identify anomalous or malicious activity across the client's infrastructure.
• Use AI-driven and agentic tools alongside your own investigative skills to run comprehensive investigations and root-cause analysis.
• Guide the business in uncovering, evicting and recovering from attacks by sophisticated threat actors.
• Collaborate with the Hunt, Cyber Threat Intelligence, Digital Forensics, Legal and Infrastructure teams to keep operations coordinated and efficient.
• Turn chaotic incident signals into clear paths forward in complex, ambiguous situations, protecting critical infrastructure, customers, users and data.

Minimum qualifications

• 5 years directly triaging, managing, investigating and remediating high-severity security incidents.
• Proven experience leading deep, complex global investigations across many disparate data sources, teams and regions.
• Deep hands-on Linux/Unix command line experience for low-level system interrogation, log analysis and artefact collection.
• Hands-on cloud forensics and incident response across multi-cloud infrastructure, including container-level forensics (e.g. Docker, Kubernetes, container runtime logs) during active investigations.
• Ability to navigate an active breach, make progress without prescriptive direction, drive remediation with integrity, and lead change through post-incident lessons learned. Preferred experience
• Operational and incident response experience in at least two of: macOS endpoints, Linux in cloud environments, microservices and containers.
• Practical AI tooling experience, including building automation workflows and scripts to enhance SOC triage and response.
• Splunk experience.
• Exposure to detection engineering, threat hunting and proactive investigations, while keeping day-to-day SOC operations as the main focus.