Security Operations Officer

Our client is seeking an experienced Security Operations Officer to join its cybersecurity team. The successful candidate will be responsible for detecting and responding to cyber threats, strengthening the security and resilience of enterprise infrastructure and data, and conducting penetration testing activities.

• Continuously monitor security alerts from SIEM, IDS/IPS, firewalls, endpoint protection platforms, and other security technologies.
• Analyse alerts to distinguish false positives from genuine security incidents and escalate where appropriate.
• Correlate and analyse log data to identify potential security events.
• Respond to escalated security incidents, including advanced threat detection, malware analysis, and forensic investigations.
• Coordinate with internal teams and external stakeholders to contain and remediate security incidents.
• Maintain detailed documentation of incidents and response activities.

• Leverage threat intelligence sources to enrich alerts and support investigations.
• Conduct proactive threat hunting to identify previously undetected threats.
• Stay current with emerging cyber threats, vulnerabilities, and attack techniques.

• Support the configuration, optimisation, and maintenance of security monitoring platforms.
• Develop and enhance detection rules, use cases, and incident response playbooks.
• Work closely with infrastructure, networking, and application teams during investigations.
• Provide regular updates to stakeholders on incident progress and remediation efforts.

• Produce reports covering security incidents, trends, root causes, and improvement recommendations.
• Maintain SOC documentation, operational procedures, and incident response processes.
• Plan and perform regular penetration tests across networks, systems, and applications.
• Utilise industry-standard tools and methodologies to identify security weaknesses.
• Produce detailed assessment reports with practical remediation recommendations.
• Work with IT and development teams to implement security improvements.

• 10–14 years' experience within a Security Operations Centre (SOC) or similar cybersecurity function.
• Security monitoring
• Incident detection and response
• Threat hunting
• Penetration testing

• Bachelor's or Master's degree in Computer Science, Cybersecurity, Information Security, or a related discipline.

• CEH
• GPEN
• OSCP
• Other recognised offensive security or cybersecurity certifications

• Strong experience with SIEM platforms.
• Hands-on experience with:
• IDS/IPS
• Firewalls
• Vulnerability Management solutions
• Strong understanding of networking technologies including TCP/IP, DNS, HTTP/S and SSL/TLS.
• Experience with Windows and Linux security.
• Knowledge of penetration testing tools and methodologies.
• Experience using threat intelligence to support investigations.
• Proven threat hunting experience.
• Strong understanding of the incident response lifecycle:
• Preparation
• Detection
• Analysis
• Containment
• Eradication
• Recovery
• Practical experience with:
• SIEM
• EDR
• Vulnerability Management
• Penetration Testing
• Log Analysis & Correlation
• Scripting & Automation
• Familiarity with security frameworks including: