Security Operations Center Analyst

Contract | 2 Positions | Immediate Start | UK Remote

Location: UK - Remote following initial onboarding and equipment collection

Contract Duration: Initial 4 weeks, potential extension

IR35 Status: Inside IR35

Start Date: Immediate

Day Rate: Competitive, dependent on experience

The Opportunity

We are urgently seeking two experienced Cyber Incident Response / Security Operations Centre (SOC) Analysts to support an established UK-based security operations team within a global organisation. This is a hands-on, operational role focused on security alert monitoring, incident investigation, phishing triage and threat response. The successful candidates will join an existing team to provide immediate operational support during a short-term period of increased demand. We are particularly interested in L1 and L2 SOC/CIRT Analysts with strong Microsoft security technology experience, although L3 analysts available for short-term engagements are also encouraged to apply.

Key Responsibilities

• Monitor, triage and investigate security alerts generated through Microsoft Defender and Microsoft Sentinel SIEM.
• Investigate and respond to potential cyber incidents, identifying threats and determining appropriate remediation actions.
• Triage and investigate reported phishing emails, including identifying malicious links, attachments and indicators of compromise.
• Review and respond to threat intelligence reports, assessing potential risks to the organisation.
• Perform initial incident containment activities, including user account isolation and device isolation where required.
• Escalate complex or high-severity incidents to senior security analysts through established case management processes.
• Maintain accurate incident records, investigation findings and actions taken.
• Support the wider security operations team in maintaining effective incident response and operational continuity.

Experience Required

• 3-5 years' experience working within a Cyber Incident Response Team (CIRT), Security Operations Centre (SOC) or equivalent security operations environment.
• Strong hands-on experience with Microsoft Defender, including security alert investigation and response.
• Direct operational experience with Microsoft Sentinel SIEM, including alert triage and incident investigation.
• Experience using Cisco Umbrella for security monitoring, investigation and threat protection.
• Proven experience investigating phishing emails and responding to email security threats.
• Familiarity with Infosec IQ and Abnormal Security platforms.
• Experience responding to threat intelligence alerts and identifying indicators of compromise.
• Ability to undertake account and device isolation activities as part of incident containment.
• Understanding of incident management, escalation procedures and security operations best practices.
• Ability to work independently and contribute effectively from day one, with minimal onboarding.
• Previous experience supporting global security operations environments.
• Experience working across L1, L2 or L3 SOC/CIRT functions.
• Exposure to Microsoft 365 security environments and identity-related security incidents.
• Experience supporting high-volume alert queues and managing multiple investigations simultaneously.
• Previous experience delivering short-term contract assignments within established security teams.

This is an urgent requirement for two immediately available contractors to provide short-term operational cover. The initial engagement will be 4 weeks, making it particularly suitable for experienced SOC/CIRT contractors between assignments or those seeking a short-term engagement. Candidates must be UK-based and available to complete initial onboarding and equipment collection before working remotely.