L3 SOC Analyst

Realtime Recruitment Limited; Belfast City District; Hybrid; GBP 60,000 - 90,000; Full time

Job summary

Realtime Recruitment Limited is seeking a Senior SOC Analyst to join our security operations team in Belfast. The role focuses on L3 SOC capabilities, SIEM onboarding, detection engineering, and advanced incident response across Windows, Linux, and Mac environments.

You will lead and mentor SOC analysts, coordinate with stakeholders, and support major incident management while operating in a hybrid Belfast setting.

Qualifications

• Strong L3 SOC / Security Operations experience in a commercial environment.
• SIEM onboarding, configuration, tuning, optimisation and use-case development.
• Strong Security Monitoring, Incident Response and Threat Intelligence experience.
• Advanced event and incident analysis, including baseline and trend analysis.
• Commercial experience in Penetration Testing and/or Security Monitoring.
• Experience providing technical leadership, mentoring and guidance to L2/L3 SOC analysts.
• Strong understanding of networking, infrastructure, OS and security architecture.
• Experience across Windows, Linux and/or Mac system administration.
• Support Major Incident Response, including threat identification, containment and remediation.
• Ability to communicate complex security issues to technical and non-technical stakeholders.
• Active SC Clearance or ability to obtain SC Clearance.

Skills

SOC experience

Security Monitoring

Incident Response

Threat Intelligence

Lead / Mentoring

Networking

Operating Systems

Windows

Linux

Mac OS

Major Incident Response

Communication

SC Clearance

Tools

Microsoft Sentinel

IBM QRadar

LogRhythm

Microsoft Defender for Endpoint

Microsoft Defender for Identity

Microsoft Defender for Cloud

KQL

Logic Apps

SOAR

Sentinel Lighthouse

Job description

Key Requirements

• Strong L3 SOC / Security Operations experience within a commercial environment.


• Proven experience with SIEM onboarding, configuration, tuning, optimisation and use-case development.


• Strong Security Monitoring, Incident Response and Threat Intelligence experience.


• Experience performing advanced event and incident analysis, including baseline and trend analysis.


• Commercial experience in Penetration Testing and/or Security Monitoring.


• Experience providing technical leadership, mentoring and guidance to L2/L3 SOC analysts.


• Strong understanding of networking, infrastructure, operating systems and security architecture.


• Experience across Windows, Linux and/or Mac system administration.


• Experience supporting Major Incident Response, including threat identification, containment and remediation.


• Ability to communicate complex security issues effectively to technical and non-technical stakeholders.


• Active SC Clearance or ability to obtain SC Clearance.

Key Technical Skills

• SIEM: Microsoft Sentinel, IBM QRadar, LogRhythm


• Microsoft Security: Microsoft Defender for Endpoint, Microsoft Defender for Identity and Cloud


• Microsoft Sentinel: KQL, use-case development, detection rules, workbooks, playbooks


• SOAR: Logic Apps and security automation


• MSSP / Multi-Tenant: Microsoft Sentinel Lighthouse, multi-customer environments and DevOps


• Threat Intelligence: Open-source and commercial intelligence


• Security Monitoring: Alert analysis, detection engineering, rule creation, tuning and optimisation


• Incident Response: Advanced investigation, containment, remediation and Major Incident Response


• Infrastructure: Networking, operating systems and infrastructure design


• Log Management: Log-source assessment, parsing, onboarding and monitoring


• Automation: SOAR, playbook development and process improvement

Certifications

Relevant industry certifications are highly desirable, including:

• CompTIA Network+


• CompTIA Security+


• CompTIA CySA+


• CISMP


• CISSP


• Other relevant SOC, SIEM, Cyber Security or Protective Monitoring certifications

Must hold UK, EU or Irish passport – Must be in Belfast – this is a hybrid role 2 days per week