Senior Cyber Security Analyst; L3

This range is provided by Info Sec People Ltd. Your actual pay will be based on your skills and experience — talk with your recruiter to learn more.

Direct message the job poster from Info Sec People Ltd.

Senior SOC Analyst (Level
3)

Hybrid: based in Canary Wharf 3x per week

Shift pattern: 4 days on / 4 days Off

We are seeking a highly capable Senior SOC Analyst (Level
3) to act as a technical and operational lead within a growing Security Operations function. This role is ideal for someone confident in leading incident investigations, developing advanced detection content, managing client communication, and contributing to the ongoing maturation of SOC capabilities.

This position requires independence, strong stakeholder communication skills, and the ability to operate within a fast‑paced environment with minimal procedural guardrails.

• Serve as the primary point of contact for clients on SOC‑related matters.
• Lead incident investigations and deliver clear briefings to technical and non‑technical stakeholders.
• Represent the SOC in governance meetings and executive‑level discussions.
• Produce concise weekly/monthly threat reports and post‑incident summaries.

• Lead development and refinement of detection content across multiple SIEM and monitoring platforms.
• Design new queries, alerts, and automated workflows to improve visibility and reduce analyst workload.
• Tune existing detection rules, reduce false positives, and increase detection fidelity.
• Map detections to frameworks (e.g., MITRE ATT&CK) and identify visibility gaps.

• Own the process for onboarding new data sources such as endpoint, cloud, and SaaS telemetry.
• Validate data quality and ensure alignment with detection and threat hunting use cases.
• Maintain a coverage matrix to monitor completeness and highlight improvement areas.
• Perform rigorous testing of all logic and data sources before deployment.
• Oversee the development and deployment of automation workflows using SOAR or equivalent technologies.
• Identify opportunities to automate enrichment, response, and triage processes.
• Define engineering standards for repeatable automation tasks and track their operational impact.
• Support SOC governance by managing shift rotas, ensuring cover, and monitoring SLA adherence.

• Maintain accurate SOC documentation including runbooks, playbooks, SOPs, and knowledge‑base content.
• Provide strategic context behind workflows to support consistency and audit readiness.
• Contribute to developing the SOC’s long‑term service architecture and capability roadmap.

• Mentor junior analysts and guide them through complex investigations.
• Support intelligence gathering, contribute to threat landscape assessments, and lead threat hunting missions.
• Ensure incidents are documented with clear learning outcomes and client‑ready reporting.
• Assist in maintaining organisational compliance with standards such as ISO 27001 and Cyber Essentials.

• Assist with the design of internal processes, workflows, and automation initiatives.
• Lead the SOC readiness component of onboarding new clients.
• Support business development by contributing technical content for proposals and participating in pre‑sales discussions.
• Identify opportunities to upsell monitoring enhancements, custom detections, or proactive threat hunting services.

• Work toward relevant technical certifications to support ongoing growth.
• Stay up to date with attacker behaviours, modern detection engineering practices, and emerging technologies.
• Proactively seek feedback and continuously improve.

The role requires:

• Accountability and humility — ability to self‑reflect and drive personal performance.
• Calmness under pressure — capable of managing high‑severity incidents confidently.
• Proactive leadership — steps in where needed without waiting for instruction.
• Strong communication skills — able to simplify complex topics for diverse audiences.
• Men…