SOC Shift Lead

As a SOC Shift Lead, you build on your solid experience as a SOC Analyst by supervising and guiding a team of SOC Analysts during your assigned shift. You ensure quality and consistency across all alerts and incidents handled by the team while serving as the primary point of escalation. In this role, you support team development, drive process improvements, and maintain clear, customer‑centric communication with all stakeholders.

You also lead quality assurance efforts and ensure that service‑level agreements (SLAs) are met.

• Shift Leadership and Team Coordination – You run shift operations, ensuring compliance with SLAs and maintaining high‑quality incident handling. You set shift agendas, balance workloads, and promptly address any process or staffing issues. You also maintain effective, customer‑centric communication with internal teams (including Security Optimisation and Engineering), customers, and their incident response partners
• Incident Triage and Investigation – You review and prioritise new alerts, taking initial ownership of high‑priority or complex incidents, and ensure proper escalation to customers and Senior SOC Analysts. You make sound, data‑driven decisions to facilitate effective triage, investigation, and escalation in line with operational standards
• Quality Assurance and Documentation – You conduct regular quality assurance (QA) of tickets to ensure SOC procedures and documentation standards are met, providing clear, constructive feedback to team members to improve technical skills and workflow consistency
• Collaboration and Mentorship – You mentor SOC Analysts in your team by offering regular, constructive feedback on triage processes and best practices. You encourage targeted training initiatives, including relevant certifications, to support career progression within the SOC
• Service Improvement – You contribute to ongoing service improvement through participation in supporting threat hunting activity led by Senior SOC Analysts, rule tuning, and process refinement initiatives. You assist in monthly reporting and post‑incident reviews to drive improvements that reflect our commitment to transparent and reliable performance

In addition to the duties performed by a SOC Analyst:

• Monitor shift activity and ensure all alerts, incidents, and tickets meet established SLAs
• Document shift activities, decisions, and process improvements accurately
• Lead regular shift briefings and debriefings (e.g. daily standups, shift handovers) to communicate updates, review performance, and reinforce best practices

• You may be required to hold or obtain UK Non‑Police Personnel Vetting (NPPV) and/or a Security Check (SC) clearance as part of this role
• A minimum of 3+ years of SOC operational experience, demonstrating a strong background in alert triage, incident analysis, and escalation
• Willingness to work towards or obtain intermediate cybersecurity certifications (e.g. SBT BTL2, CREST Registered Intrusion Analyst)
• Proficiency with SIEM platforms, endpoint security tools, and ticketing systems, with an ability to make clear, data‑driven decisions under pressure
• Proven teamwork and mentoring abilities, ensuring that technical and operational skills are continuously enhanced within the team

• Operating Systems
  - Possess detailed knowledge of Windows and Linux system architectures, with a clear understanding of how event logs (e.g., Windows Event Viewer, Syslog) reflect system security posture
• Networking and Protocols
  - Have a comprehensive understanding of TCP/IP, DNS, DCHP, VPNs, SSL/TLS, and network forensics concepts to validate network‑based alerts and anomalies
• Cybersecurity Frameworks
  -…