Senior SOC Analyst

Senior SOC Analyst

Location: London
Working Pattern: 4 days onsite, 1 day remote
Hours: Monday-Friday, standard business hours (no shift work)

Overview

We are seeking an experienced Senior SOC Analyst to support a major cyber security transformation programme within a global enterprise environment.

This role is ideal for a senior, hands‑on Security Operations professional who combines strong incident investigation and threat analysis skills with experience in detection engineering, operational process development, and stakeholder engagement.

Working as a key bridge between regional and global Security Operations teams, you will play a critical role in the globalisation of security monitoring capabilities, helping to onboard, validate, optimise, and operationalise detection content while ensuring analysts have effective procedures and playbooks in place.

Key Responsibilities

Detection Rule Globalisation

• Lead the onboarding of EMEA detection rules into the Global Security Operations Centre.
• Review and validate detection logic, thresholds, alert conditions and expected behaviours across SIEM platforms such as Microsoft Sentinel, Splunk, QRadar, Arc Sight, Exabeam, and Log Rhythm
  .
• Ensure accurate mapping of detection content to recognised threat frameworks, including MITRE ATT&CK
  .
• Identify detection gaps, duplicate content and optimisation opportunities through detection engineering, threat hunting, and alert tuning activities.
• Support standardisation of monitoring capabilities across global security teams covering EDR, XDR, cloud, identity, email, and network security telemetry
  .

SOP Development & Operationalisation

• Develop and maintain Standard Operating Procedures (SOPs) for Tier 1 and Tier 2 SOC teams.
• Create investigation workflows, triage processes and escalation procedures for security incidents across Microsoft Defender, Crowd Strike, Cortex XDR, Sentinel One, Carbon Black, Azure, AWS, and GCP environments
  .
• Define required enrichment data, threat intelligence inputs and decision‑making criteria.
• Ensure procedures are practical, repeatable and aligned with global security operations.
• Develop analyst playbooks and support SOAR and automation initiatives using technologies such as Microsoft Sentinel Automation, Cortex XSOAR, Splunk SOAR, Tines, and Swimlane
  .

Threat Analysis & Detection Validation

• Validate the effectiveness of security detections through threat-focused analysis and threat hunting activities.
• Perform quality assurance reviews of detection rules and analyst handling processes.
• Review and simulate alert scenarios to confirm investigation workflows and expected outcomes.
• Analyse attacker tactics, techniques and procedures (TTPs) and ensure detection content remains aligned with emerging threats.
• Utilise KQL, SPL, SQL, log analysis, event correlation, and telemetry investigation to validate detection's and support investigations.
• Support continuous improvement of detection and response capabilities.

Stakeholder Management & Collaboration

• Work closely with Security Operations, Detection Engineering, Threat Intelligence, Incident Response, and Global SOC teams.
• Act as a bridge between regional and global security functions.
• Deliver knowledge transfer sessions and operational walkthroughs.
• Translate complex technical concepts, detection logic, threat activity, and investigation outcomes into clear, business‑friendly language.

Documentation & Governance

• Maintain high‑quality documentation of detection content and operational procedures.
• Ensure traceability between detection logic, threat mappings and analyst workflows.
• Support audit and compliance requirements through robust process documentation.

Essential Skills & Experience

• Minimum 4 years' experience as a Tier 2 SOC Analyst (or recent Tier 3 experience).
• Stro…