SOC Team Leader

Location: On-site Hertfordshire Area

Clearance: Must hold or be eligible for DV Clearance

Schedule: 2 days, 2 nights, 4 off (12-hour shifts)

We are seeking a Team Leader to join our Security Operations Centre (SOC) based on-site in Hertfordshire. You'll be responsible for leading a team of analysts on a shift pattern, providing tactical leadership, ensuring high-quality triage and analysis, and contributing to continuous improvement of detection and response operations. This is a fantastic opportunity to play a key role in securing critical national infrastructure while developing your career within a high-assurance environment.

Key Responsibilities

• Lead a shift team of SOC Analysts, providing guidance, mentoring, and support on a 24/7 operational rota.
• Oversee real-time monitoring, triage, investigation, and escalation of security alerts.
• Act as point of escalation for high-priority incidents and ensure correct response procedures are followed.
• Drive improvements in detection rules, response procedures, and knowledge-sharing using frameworks like MITRE ATT&CK.
• Ensure accurate documentation of incidents and shift handover notes.
• Represent the SOC in stakeholder meetings as required, delivering briefings and updates.
• Maintain high situational awareness of threat landscape relevant to client environment.
• Support onboarding and continuous training of new analysts.
• Foster a positive, performance-driven team culture in a high-tempo environment.

Essential Skills & Experience

• Proven experience working in a SOC, including shift-based or high-tempo environments.
• Strong familiarity with SIEM technologies (especially Microsoft Sentinel and Splunk).
• Confident understanding of networking fundamentals (TCP/IP, DNS, firewalls, proxies, VPNs).
• Exposure to MITRE ATT&CK and threat-informed detection engineering.
• Experience leading or mentoring junior analysts in a technical security environment.
• Strong decision-making and incident management capabilities.
• Clear and concise written and verbal communication skills.

Desirable Qualifications

• Experience working within the defence or critical national infrastructure space.
• Exposure to threat intelligence and/or static malware analysis.
• Familiarity with scripting languages (Python, PowerShell, Bash, etc.).

Note: Candidates must be eligible for DV (Developed Vetting) security clearance, which typically requires sole UK nationality and long-term UK residency.