L3 SOC Analyst

Saviynt's AI-powered identity platform manages and governs human and non-human access to all of an organization's applications, data, and business processes. Customers trust Saviynt to safeguard their digital assets, drive operational efficiency, and reduce compliance costs. Built for the AI age, Saviynt is today helping organizations safely accelerate their deployment and usage of AI. Saviynt is recognized as the leader in identity security, with solutions that protect and empower the world’s leading brands, Fortune 500 companies and government institutions.

For more information, please visit

Location:

United Kingdom

Type:
Full-time, permanent

Due to the nature of the UK Government projects this role supports, this position is classified as a Reserved Post. In accordance with the Civil Service Nationality Rules, paragraph 1 of Schedule 23 and paragraph 5 of Schedule 22 of the Equality Act 2010, we can only accept applications from persons with UK residency (at least five years).

Successful candidates must undergo National Security Vetting (NSV). This role requires Security Check SC level clearance as a minimum. Any offer of employment is strictly conditional upon the candidate successfully obtaining and maintaining this clearance.

To meet the vetting criteria, you will be required to have been resident in the UK for a minimum of 5 years immediately prior to your application. Failure to obtain clearance or a lapse in residency history may result in the withdrawal of the employment offer, and you will not be entitled to any compensation from Saviynt as a result.

In line with the Immigration, Asylum and Nationality Act 2006, all shortlisted candidates will be required to provide original documentation verifying their Right to Work in the UK and their British Citizenship during the initial interview stage. We conduct thorough Baseline Personnel Security Standard (BPSS) checks as a precursor to all higher-level clearances.

We are establishing a modern Security Operations Centre designed to deliver proactive, intelligence-driven security outcomes. Moving beyond traditional reactive monitoring, our SOC emphasises AI, automation, detection engineering, and deep cloud security visibility to identify and neutralise sophisticated threats at scale.

• Act as the final escalation point for complex incidents originating from L1/L2 analysis.
• Lead investigations into high‑severity security events, including those impacting AWS, Kubernetes clusters and hybrid environments.
• Perform advanced forensic analysis across endpoints, cloud workloads, and network telemetry to determine root cause, impact, and remediation actions.
• Correlate telemetry from SIEM, EDR, CSPM, and cloud‑native sources to identify sophisticated attack chains.

• Design, develop, and maintain automated response playbooks within the SOAR platform to improve response efficiency.
• Build and maintain automation scripts (Python, Go, etc.) for alert enrichment, evidence collection, and containment.
• Integrate security platforms via APIs to enable streamlined, automated detection and response workflows.
• Identify opportunities to reduce Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR) through automation and process optimisation.

• Conduct proactive threat hunting across enterprise and cloud environments using intelligence‑driven and hypothesis‑based methodologies.
• Serve as an SME for cloud security monitoring leveraging tools such as AWS Guard Duty, Cloud Trail, Crowd Strike, and Proofpoint.
• Develop and tune SIEM detections, correlation rules, and EDR queries aligned to MITRE ATT&CK tactics and emerging threat…