L3 SOC Analyst

Anson McCade; Belfast City District; Presencial; GBP 60.000 - 98.000; Jornada completa

Descripción de la vacante

Anson McCade Pty is seeking a Senior SOC Analyst to act as the escalation point in our Belfast Cyber Security Operations Centre. You’ll take incidents escalated from Tier 1 and 2 analysts, assess business impact and advise the appropriate response path.

You’ll triage threat intelligence, run threat hunts across the SIEM and mentor two analysts, while supporting the rollout and management of Microsoft Sentinel, Defender for Endpoint and other Microsoft security products.

Formación

• SC-200 certification is mandatory.
• Eligibility for SC clearance is mandatory.
• Senior SOC Analyst level proven experience.
• Hands-on with Microsoft Sentinel, Defender for Endpoint and KQL.
• Experience onboarding, configuring, tuning and reporting on SIEM solutions.
• Leadership and mentoring experience.
• Commercial security monitoring experience and/or pentesting.
• Solid understanding of OS, networking and infrastructure design.
• System administration knowledge across Windows/Linux/Mac.
• Ability to explain technical issues to non-technical stakeholders.

Responsabilidades

• Handle incidents escalated by L1/L2 analysts and advise on response paths.
• Perform advanced event and incident analysis, baselining and trends.
• Conduct intelligence-led threat hunting using IOCs and TTPs.
• Support Major Incident Response from a monitoring perspective.
• Provide guidance to L2/L3 analysts and cover SOC Manager duties when absent.
• Oversee a virtual team of L1/L2 analysts, including training and shift coverage.
• Identify SIEM improvements: use case development, rules and tuning.
• Design onboarding of new systems and log sources.
• Produce stakeholder and client reporting and manage client engagement.
• Join the on-call rota to support out-of-hours activity.

Conocimientos

Microsoft Sentinel

Defender for Endpoint

KQL

SIEM tuning & reporting

Threat hunting

Mentoring/leadership

Communication

OS & networking knowledge

Educación

Degree in Computing or related

Cyber Security master’s (considered)

Herramientas

IBM QRadar

LogRhythm

Azure Lighthouse

Descripción del empleo

Must-haves: Microsoft SC-200 certification and eligibility for SC clearance.

You’ll be the senior escalation point in a Belfast Cyber Security Operations Centre (CSOC). You’ll take incidents escalated from Tier 1 and Tier 2 analysts, assess their business impact, and recommend the response and escalation path.

You’ll triage threat intelligence (IOCs and TTPs) from multiple sources, run threat hunts across the SIEM, and help organisations identify, isolate and contain security issues. You’ll also guide and mentor two analysts, without direct line management, and support the rollout and management of IBM QRadar, Microsoft Sentinel, Defender for Endpoint, Defender for Identity and Defender for Cloud.

Key responsibilities

• Handle security incidents escalated by L1 and L2 analysts, carry out business impact analysis and recommend response actions and escalation paths
• Perform advanced event and incident analysis, including baselining and trend analysis
• Conduct intelligence-led threat hunting using IOCs and TTPs, investigating suspicious activity through the SIEM
• Support Major Incident Response from a protective monitoring perspective, helping teams identify, contain and remediate threats
• Give timely advice on response plans based on incident type and severity
• Oversee daily SOC checklists: log review, management reporting, alert analysis and escalation follow-up
• Provide oversight, guidance and mentoring to L2 and L3 analysts, and cover SOC Manager duties when they are absent
• Oversee a virtual team of L1 and L2 analysts, including objectives, performance reviews, training and shift cover
• Identify SIEM improvements: use case development, rule creation, tuning and optimisation
• Help design the onboarding of new systems, including assessing, parsing and onboarding log sources
• Improve SOC procedures and processes, with SOC Manager approval
• Produce stakeholder and client reporting and manage client engagement
• Join the on-call rota to support L1 analysts working out of hours
• Stay current on cyber security trends and threat intelligence to guide the team's detection capability
• Microsoft SC-200 certification (mandatory)
• Eligible for SC clearance (mandatory)
• Proven experience at Level 3 SOC Analyst or senior security operations level
• Strong hands-on experience with Microsoft Sentinel, Microsoft Defender for Endpoint (MDE) and KQL
• Experience onboarding, configuring, tuning and reporting on SIEM solutions
• Leadership and mentoring experience
• Commercial experience in security monitoring and/or penetration testing
• Solid understanding of operating systems, networking and infrastructure design
• System administration knowledge across one or more of Windows, Linux or Mac
• Ability to explain technical issues clearly to non-technical stakeholders at all levels
• Strong written and verbal communication, and a self-motivated, flexible approach
• Degree in Computing or a related subject; a Cyber Security master's with relevant experience is also considered
• In-depth Microsoft Sentinel expertise: use case and rule development, workbooks and playbooks, KQL, Logic Apps and SOAR
• Managing Sentinel as an MSSP, including Azure Lighthouse and multi-customer environments using DevOps
• Wider Microsoft security experience across Defender for Endpoint, Identity and Cloud
• Other SIEM platforms, such as IBM QRadar and LogRhythm
• Certifications such as Network+, Security+, CySA+, CISMP or CISSP