Soc Analyst Level 1

The SOC Analyst is a frontline, shift‑based role operating within a 24/7 Security Operations Centre. The role is responsible for monitoring, triaging, analysing, and investigating security alerts and events using SIEM and SOAR platforms to detect potential security incidents and protect monitored environments.

Working within defined procedures, runbooks, and escalation paths, run SOC Analyst performs initial investigations, validates alerts, and supports incident response activities. The role requires strong attention to detail, disciplined execution, and the ability to work effectively in a high‑volume, operational environment.

You will continuously monitor security alerts, logs, and event data across customer and internal environments, identifying suspicious or malicious activity. You will triage and analyse alerts to determine whether they represent potential security or service incidents, and prioritise them in line with defined security incident management policies.

You will conduct first‑line investigations using SIEM, SOAR, and supporting security tools, validating alerts, gathering relevant evidence, and assessing initial impact and severity. Where indicators of compromise or attack activity are identified, you will recognise successful or unsuccessful attack attempts and escape to senior analysts or incident responders with clear context.

You will support incident containment and remediation activities by following runbooks and customer guidance, ensuring actions are documented and carried out consistently. High‑quality case management is a core responsibility: you will create and maintain incident tickets, record investigation steps and findings, and produce clear incident summaries and investigation notes using internal knowledge bases and research.

You will contribute to post‑incident reviews by sharing findings and identifying opportunities to improve detection, response, or operational processes. You will also apply threat intelligence provided by the SOC to support alert analysis and investigations.

Operational discipline is essential. You will follow defined SOC procedures, documentation standards, and shift‑handover processes, ensuring continuity across shifts. You will participate fully in the 24/7 shift rota, working collaboratively with other analysts to maintain consistent monitoring coverage.

You will have at least one year working as a SOC Analyst at level 1 or similar, with foundational understanding of cyber security concepts, including TCP/IP networking, common log sources, and basic attack techniques. You will be comfortable working with a SIEM platform such as Splunk, Microsoft Sentinel, or an equivalent tool, and have basic knowledge of common operating systems including Windows, Linux, and macOS.

You will demonstrate strong analytical and problem‑solving skills, with the ability to assess alerts, follow investigative processes, and make sound decisions within defined procedures. Clear written and verbal communication skills are essential, particularly for accurate ticketing, escalation, and shift handover.

You will be able to work calmly and effectively in a shift‑based operational environment, managing workload and maintaining focus during periods of high alert volume. You will be comfortable following procedures, working with minimal supervision, and continuously learning from feedback and operational experience. Awareness of scripting, query languages, or rule‑based detection is advantageous but not required.

• You will have at least one year working as a SOC Analyst at level 1 or similar.
• Experience or strong interest in cyber security or IT operations
• Entry‑level or foundation cyber security certifications desirable (CySA+, SC‑200)
• Experience with cloud platforms such as Microsoft Azure and/or AWS is desirable
• Proficiency with Microsoft Office tools, particularly Excel and Word

• Eligibility for, or holding, UK SC Clearance
• Willingness to work within a 24/7 shift‑based SOC environment

We’re a business with a global reach that empowers local teams, and we undertake hugely…