SOC Level 2 Security Analyst

Who you are

• You will have hands‑on experience working with SIEM platforms such as Splunk, Microsoft Sentinel, or QRadar, and a strong understanding of incident response workflows and escalation management
• You will be comfortable analysing security telemetry, understanding attacker behaviour, and applying log‑ and artefact‑based investigation techniques
• You will demonstrate strong analytical thinking, sound decision‑making, and the ability to remain effective during high‑pressure incidents
• Clear, professional communication—both written and verbal—is essential, as is the ability to work independently while following and improving structured operational processes
• 2–4 years’ experience in the IT security industry, ideally within a SOC or NOC environment, including experience operating at SOC L1 level
• Relevant cybersecurity certifications desirable (eg GIAC, CySA+, SC‑200)
• Experience working with cloud platforms such as Microsoft Azure and/or AWS
• Proficiency with Microsoft Office tools, particularly Excel and Word
• Eligibility for, or holding, UK SC Clearance
• Willingness to work within a 24/7 shift‑based SOC environment, including on‑call duties

What the job involves

• The SOC Analyst (L2) plays a critical role in the detection, investigation, and management of security alerts and incidents escalated from SOC Analyst (L1) teams
• The position focuses on in‑depth analysis, incident validation, tactical response coordination, and continuous improvement of security monitoring and response capabilities
• Operating within a 24/7 Security Operations Centre, the L2 Analyst serves as a technical escalation point for junior analysts, working closely with internal IT and security teams as well as customers to contain and remediate security incidents
• The role contributes directly to improving detection quality, response efficiency, and the overall effectiveness of SOC operations
• You will investigate security alerts and events escalated from Level 1 analysts, validating and classifying activity to determine whether it represents a confirmed security incident
• This includes performing detailed analysis to understand root cause, scope, impact, and attacker behaviour using SIEM platforms and supporting telemetry
• You will coordinate and support incident response activities in line with defined SOC and customer processes, assisting with containment, eradication, and recovery actions
• During high‑severity or customer‑impacting incidents, you will follow major incident procedures and ensure timely, accurate escalation to stakeholders
• You will provide technical guidance to L1 analysts during live incidents and help maintain investigation quality under pressure
• You will execute defined SOAR playbooks as part of incident response and provide structured feedback to improve automation, response consistency, and efficiency
• You will maintain awareness of SOC performance metrics and service levels, such as MTTD and MTTR, and actively contribute to improving investigation quality and response outcomes
• You will apply threat intelligence to investigations and alert triage, maintaining awareness of emerging threats, vulnerabilities, and attacker techniques
• Incident learnings and threat insights will be fed back into detection logic to continuously enhance SOC monitoring capabilities
• You will also contribute to the development and tuning of SOC detection use cases, ensuring alerting remains relevant, effective, and aligned to current threat activity
• This includes supporting onboarding of new services, identifying detection gaps, and recommending improvements to tooling, processes, and coverage
• Clear and accurate documentation is a key part of the role
• You will maintain investigation records, runbooks, and playbooks, produce post‑incident reports for customers and internal stakeholders, and contribute to operational and service reporting
• You will help document and implement improvements to event and incident management processes
• Collaboration is essential
• You will work closely with IT, security, and technical teams to resolve incidents and reduce risk, act as a mentor and escalation point for L1 analysts, and support continual service improvement by identifying recurring issues and proposing corrective actions

Benefits

• A people focused business
• Excellent opportunities to grow your career, including an online training platform with 3000+ courses, accessible from everywhere, to sharpen your skills
• A varied client base