SIOC Analyst

At UBDS, we help organisations transform through cloud, cyber security, AI and digital innovation. As our Managed Services capability grows, we're looking for a SIOC Analyst to join our Security and Infrastructure Operations Centre, helping protect and support critical customer environments.

This is a hands-on cyber security role focused on security monitoring, threat detection, incident investigation and response. You'll work across complex cloud and enterprise environments, investigating security events, responding to incidents and supporting Digital Forensics and Incident Response (DFIR) activities.

Our technology landscape is primarily Microsoft and AWS, alongside SIEM and wider security tooling.

Location:

Manchester (Office-based)

Working Pattern:
Monday to Friday | Rotating shifts between 08:00-20:00 | On-call rota

• Monitor and investigate security alerts, events and suspicious activity across customer environments.
• Triage security alerts and determine severity, impact and appropriate response actions.
• Investigate potential security incidents across endpoints, identities, cloud environments, networks and applications.
• Use SIEM and security tooling to analyse logs, correlate events and identify suspicious behaviour.
• Support incident response activities from initial detection and investigation through to containment, remediation and recovery.
• Perform initial DFIR activities, including evidence collection, log analysis, timeline analysis and investigation of compromised systems or accounts.
• Investigate phishing, malware, suspicious authentication activity, account compromise and other common security threats.
• Support security monitoring and investigation across Microsoft and AWS cloud environments.
• Analyse indicators of compromise and support threat hunting activities.
• Escalate complex or high-severity incidents to senior security specialists and incident response teams.
• Support vulnerability, security and threat management activities where required.
• Document investigations, findings, actions and recommendations clearly.
• Contribute to incident reports and post-incident reviews.
• Help develop and improve security monitoring use cases, detection rules and operational playbooks.
• Identify recurring threats and opportunities to improve detection and response capabilities.
• Work closely with customers, cloud engineers, infrastructure teams and other security specialists during investigations.
• Contribute to continual improvement across the SIOC and wider Managed Services capability.

This is not an exhaustive list of requirements. We're looking for someone with experience across several of these areas and an appetite to continue developing their cyber security and incident response capability.

• Experience working within a SOC, SIOC, Cyber Security Operations or similar operational security environment.
• Experience monitoring, triaging and investigating security alerts and incidents.
• Hands-on experience using SIEM or security monitoring platforms.
• Experience investigating security events using logs and telemetry from multiple sources.
• Good understanding of common cyber threats, attack techniques and indicators of compromise.
• Understanding of incident response processes, including identification, containment, remediation and recovery.
• Experience or knowledge of Microsoft security technologies and environments.
• Understanding of Microsoft identity and endpoint security, including Entra  Microsoft Defender technologies.
• Experience or understanding of security monitoring within AWS environments.
• Some practical knowledge of DFIR principles and investigation techniques.
• Understanding of endpoint, identity, network and cloud security concepts.
• Ability to analyse technical information and build a clear picture of what has happened during an incident.
• Strong analytical and problem-solving skills with a methodical approach to investigations.
• Ability to prioritise multiple alerts and incidents within a fast-paced operational environment.
• Strong written and verbal communication skills, including the ability to clearly document and communicate security incidents.

We're particularly interested in candidates who have some exposure to Digital Forensics and Incident Response or who want to develop further in this area.

Useful experience could include:

• Security incident investigation and evidence gathering.
• Endpoint and host-based investigation.
• Log and event analysis.
• Timeline development and analysis.
• Malware or suspicious file…