SOC Team Leader

Location:On-site Hertfordshire Area
Clearance: Must hold or be eligible for DV Clearance
Schedule: 2 days, 2 nights, 4 off (12-hour shifts)

We are seeking a Team Leader to join our Security Operations Centre (SOC) based on-site in Hertfordshire. You'll be responsible for leading a team of analysts on a shift pattern, providing tactical leadership, ensuring high-quality triage and analysis, and contributing to continuous improvement of detection and response operations.

This is a fantastic opportunity to play a key role in securing critical national infrastructure while developing your career within a high-assurance environment.

• Lead a shift team of SOC Analysts, providing guidance, mentoring, and support on a 24/7 operational rota.
• Oversee real-time monitoring, triage, investigation, and escalation of security alerts.
• Act as point of escalation for high-priority incidents and ensure correct response procedures are followed.
• Drive improvements in detection rules, response procedures, and knowledge-sharing using frameworks like MITRE ATT&CK.
• Ensure accurate documentation of incidents and shift handover notes.
• Represent the SOC in stakeholder meetings as required, delivering briefings and updates.
• Maintain high situational awareness of threat landscape relevant to client environment.
• Support onboarding and continuous training of new analysts.
• Foster a positive, performance-driven team culture in a high-tempo environment.
• Proven experience working in a SOC, including shift-based or high-tempo environments.
• Strong familiarity with SIEM technologies (especially Microsoft Sentinel and Splunk
  ).
• Confident understanding of networking fundamentals (TCP/IP, DNS, firewalls, proxies, VPNs).
• Exposure to MITRE ATT&CK and threat-informed detection engineering.
• Experience leading or mentoring junior analysts in a technical security environment.
• Strong decision-making and incident management capabilities.
• Clear and concise written and verbal communication skills.

• Experience working within the defence or critical national infrastructure space.
• Exposure to threat intelligence and/or static malware analysis.
• Familiarity with scripting languages (Python, Power Shell, Bash, etc.).

Note: Candidates must be eligible for DV (Developed Vetting) security clearance, which typically requires sole UK nationality and long-term UK residency.