L3 SOC Analyst

5 мес. назад

United KingdomEuropeMiddleRemote

Security Operations Center Analyst position requiring UK residency and Security Check SC clearance.

О компании

's AI-powered identity platform manages and governs human and non-human access to all of an organization's applications, data, and business processes. Customers trust to safeguard their digital assets, drive operational efficiency, and reduce compliance costs. Built for the AI age, is today helping organizations safely accelerate their deployment and usage of AI. is recognized as the leader in identity security, with solutions that protect and empower the world’s leading brands, Fortune 500 companies and government institutions. For more information, please visit . Location: United Kingdom Type: Full-time, permanent   Due to the nature of the UK Government projects this role supports, this position is classified as a Reserved Post.

Обязанности

Incident Response & Technical Escalation
Act as the final escalation point for complex incidents originating from L1/L2 analysis.
Lead investigations into high-severity security events, including those impacting AWS, Kubernetes clusters and hybrid environments.
Perform advanced forensic analysis across endpoints, cloud workloads, and network telemetry to determine root cause, impact, and remediation actions.
Correlate telemetry from SIEM, EDR, CSPM, and cloud-native sources to identify sophisticated attack chains.
Security Automation & SOAR Engineering
Design, develop, and maintain automated response playbooks within the SOAR platform to improve response efficiency.
Build and maintain automation scripts (Python, go, etc.) for alert enrichment, evidence collection, and containment.
Integrate security platforms via APIs to enable streamlined, automated detection and response workflows.
Identify opportunities to reduce Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR) through automation and process optimisation.
Threat Hunting & Detection Engineering
Conduct proactive threat hunting across enterprise and cloud environments using intelligence-driven and hypothesis-based methodologies.
Serve as an SME for cloud security monitoring leveraging tools such as AWS GuardDuty, CloudTrail, CrowdStrike, and Proofpoint.
Develop and tune SIEM detections, correlation rules, and EDR queries aligned to MITRE ATT&CK tactics and emerging threat intelligence.
Mentorship & Continuous Improvement
Provide technical mentoring and guidance to L1/L2 analysts to strengthen SOC capability.
Maintain and enhance SOC documentation including SOPs, runbooks, and response playbooks.
Analyse incident trends and operational metrics to recommend improvements in detection coverage, automation effectiveness, and security posture.

Требования

Bachelor’s degree in Computer Science, Cybersecurity, or related discipline (or equivalent industry experience).
Extensive experience in Security Operations with demonstrable time in a senior analyst, threat hunter, or L3 role.
Strong hands-on experience in cloud security monitoring and incident response across AWS - AWS experience is essential for this role.
Proven scripting and automation capability using Python, Go, PowerShell,Bash,etc.
Practical experience with SOAR platforms (e.g., CrowdStrike Fusion SOAR) and SIEM technologies (e.g., CrowdStrike Falcon, Splunk, QRadar, Microsoft Sentinel).
Deep understanding of EDR tooling, host/network forensics, and detection engineering practices.
Strong working knowledge of the MITRE ATT&CK framework and its application in threat detection and hunting.