Senior Soc Analyst

Role & responsibilities

Own the SOC operating model detection coverage, response playbooks, escalation paths and shift structure.

• Lead incident response end-to-end: detection, containment, eradication, recovery and post-incident RCA, mapped to MITRE ATT&CK.
• Design, build and tune detections and use-cases in the SIEM across client SaaS instances and the corporate/M365 environment.
• Run proactive threat hunting across cloud, endpoint, identity and network telemetry.
• Own the multi-cloud security-monitoring posture (Defender for Cloud / Sentinel, AWS GuardDuty / Security Hub, GCP SCC, OCI Cloud Guard).
• Coordinate vulnerability management and remediation tracking with Infrastructure and DevOps, and oversee closure of penetration-test findings.
• Interface with client security teams and support customer security questionnaires and assurance for the SaaS.
• Report security posture, incidents and SOC KPIs to leadership.
• Mentor and quality-assure the SOC Analyst; build runbooks and the SOC knowledge base.
• Drive automation / SOAR to reduce mean time to detect and respond (MTTD / MTTR).
• The pod integrates with the 247 support model and works closely with IT Infrastructure, DevOps/cloud and delivery.

Preferred candidate profile

• 3-5 years in SOC / security operations, incident response or threat detection, including hands-on IR leadership.
• Strong SIEM engineering (Sentinel, Splunk, QRadar or Elastic), detection use-case design and query languages (KQL, SPL).
• Deep understanding of MITRE ATT&CK, the incident lifecycle and forensic fundamentals.
• Solid multi-cloud security knowledge (Azure, AWS, GCP, OCI) and M365 / Entra ID identity threats, including AiTM / phishing.
• Experience with EDR, firewall and vulnerability-management tooling.
• Strong communication and stakeholder management able to brief leadership and clients.
• Bachelor's degree or equivalent work experience.