L1 & L2 SOC Analyst

Sanderson Government & Defence; England; On-site; GBP 111,000 - 138,000; Part time

Job summary

Sanderson Government & Defence is seeking L1 and L2 SOC Analysts to join a 5-month public sector cyber security programme in Buckinghamshire. The role sits in a 24/7 Security Operations Centre, focusing on monitoring, detection, investigation and incident response within a Microsoft Defender/Entra ID environment.

The positions require Active DV Clearance and operate in a shift-based environment, with daily rates of £600-£650 for L1 and £700-£750 for L2, inside IR35.

Qualifications

• DV clearance is required to work on public sector assignments.
• Experience in a Security Operations Centre (SOC) environment is essential.
• Hands-on experience with Microsoft Defender and Entra ID.
• Strong monitoring, alert triage and incident investigation skills.
• Excellent stakeholder communication and ability to operate in shift-based environments.

Responsibilities

• Monitor security events and triage alerts using Microsoft Defender and related platforms.
• Conduct real-time monitoring and investigate suspicious activity.
• Lead or assist incident investigations and containment activities.
• Support identity and access security monitoring with Microsoft Entra ID.
• Produce operational reports and help improve SOC processes and detection capabilities.

Skills

DV Clearance

SOC experience

Microsoft Defender

Microsoft Entra ID

Threat monitoring

Incident response

Log analysis

Communication skills

Shift work

Job description

£600-£650 per day (L1) | £700-£750 per day (L2) | Inside IR35

5-Month Contract (2 year programme)

Buckinghamshire | Shift-Based Environment

Active DV Clearance Required

An exciting opportunity has arisen for L1 and L2 SOC Analysts to join a high-profile public sector cyber security programme. Working within a fast-paced Security Operations Centre (SOC), you will play a key role in monitoring, detecting, investigating, and responding to cyber security threats across a complex enterprise environment.

This role will focus on the Microsoft Security Stack, particularly Microsoft Defender and Microsoft Entra ID, providing the opportunity to work with cutting-edge security tooling while supporting the protection of critical systems and services.

The Role

As a SOC Analyst, you will be responsible for monitoring security events, investigating alerts, and supporting incident response activities within a 24/7 operational environment. You'll work closely with cyber security teams and stakeholders to identify threats, elevate incidents, and continuously improve security operations capabilities.

Opportunities are available at both L1 (Junior) and L2 (Senior) levels, with responsibilities aligned to experience and technical capability.

Key Responsibilities

Security Monitoring & Detection

• Monitor and triage security alerts using Microsoft Defender and associated security platforms.
• Conduct real-time monitoring of security events and suspicious activity.
• Analyse and investigate alerts across endpoints, users, and identity services.
• Monitor and review logs across enterprise systems and environments.

Incident Response

• Perform security incident triage and investigation activities.
• Escalate incidents in accordance with operational procedures.
• Support containment, remediation, and recovery efforts during security incidents.
• Collaborate with internal teams and stakeholders throughout investigations.

Identity & Access Security

• Investigate authentication and identity-based threats using Microsoft Entra ID.
• Monitor privileged access activities and suspicious account behaviour.
• Support identity security monitoring and access control best practices.

SOC Operations

• Produce operational reports and incident summaries.
• Contribute to monthly service reviews and continuous improvement initiatives.
• Ensure compliance with security standards, processes, and reporting requirements.
• Support the enhancement of SOC procedures and detection capabilities.

Essential Skills & Experience

• Active DV Clearance.
• Experience working within a Security Operations Centre (SOC) environment.
• Hands-on experience with Microsoft Defender.
• Experience using Microsoft Entra ID (Azure AD).
• Security monitoring, alert triage, and incident investigation experience.
• Understanding of cyber security threats, attack techniques, and incident response processes.
• Experience analysing security logs and events.
• Strong communication and stakeholder engagement skills.
• Ability to operate effectively within a shift-based environment.

Reasonable Adjustments:

Respect and equality are core values to us. We are proud of the diverse and inclusive community we have built, and we welcome applications from people of all backgrounds and perspectives.

Our success is driven by our people, united by the spirit of partnership to deliver the best resourcing solutions for our clients.