Lead Security Analyst

Made Tech Limited; United Kingdom; On-site; GBP 90,000 - 120,000; Full time

Job summary

Made Tech Limited’s Cyber practice seeks a Lead Security Analyst to set the technical direction for the SOC and own the quality of detections, threat hunting, and incident response on the engagement.

You’ll shape the threat landscape, drive the detection backlog, and build the analysts around you, pairing on complex investigations and ensuring detections are version‑controlled and peer‑reviewed for continuous improvement.

Qualifications

• One of CISSP/CISM/CASP+ or equivalent senior credential.
• Experience leading detection engineering in a SOC or similar environment, including writing and tuning detections and coverage against MITRE ATT&CK.
• Experience designing or improving a log and telemetry pipeline, including cloud‑hosted services (AWS preferred).
• Experience running the intelligence cycle as a managed discipline: collection planning, production, feedback.
• Knowledge of UK government security standards and frameworks (NCSC CAF Objective C, GovAssure, OFFICIAL handling).
• Experience growing the capability of less experienced analysts through pairing and mentoring.

Responsibilities

• Set the detection engineering standard: author, tune, peer‑review detections; manage false positives; map to MITRE ATT&CK; train L1/L2 analysts.
• Own the threat‑landscape narrative for your engagement; translate advisories and threat intel into hunt themes and detection priorities.
• Run the intelligence cycle as a managed discipline with a collection plan, timely products, and feedback loops.
• Establish and lead security incident response practice: playbooks, severity models, exercises, and blameless post‑mortems.
• Design the log/telemetry pipeline for detections, including application telemetry in cloud environments (AWS).
• Be the trusted interface for client security stakeholders; communicate detections and risks clearly with fidelity.
• Grow the analysts around you through pairing and structured mentoring; build team capability.
• Contribute detection content, runbooks, and lessons learned back into shared practice resources.

Skills

CISSP

CISM

CASP+

Detection engineering leadership

Incident response leadership

Threat landscape storytelling

Mentoring junior analysts

Client-facing communication

Tools

KQL

SPL

EQL

Sigma

MITRE ATT&CK mapping

AWS telemetry design

Job description

Made Tech helps UK public sector organisations build and run better digital services. Our Cyber practice sits at the heart of that mission—working alongside government departments, agencies, and critical national infrastructure owners to improve how they detect, respond to, and learn from cyber threats. As a Lead Security Analyst, you’ll be the most senior analyst on your engagement, setting the technical direction for the SOC and owning the quality of what the team produces—from detection engineering to threat-hunting to incident response.

This isn’t a role where you disappear into a ticket queue. You’ll shape the threat‑landscape narrative for your engagement, drive the detection backlog, and build the capability of the analysts around you. That means pairing on complex investigations, setting tradecraft standards, and making sure the team’s detection content is version‑controlled, peer‑reviewed, and continuously improved—not left to age in a SIEM. You’ll also be the trusted technical interface for client security stakeholders, translating what the SOC is seeing into the language that informs decisions.

The UK public sector context matters here. You’ll align your work to NCSC guidance, the Cyber Assessment Framework, and OFFICIAL handling requirements—not because compliance is the goal, but because those frameworks reflect the real risk environment your clients operate in. You’ll engage with cross‑government security communities, feed detection content and runbooks back into the Cyber practice, and help grow a bench of analysts who can operate at the same standard.

Key responsibilities

• Set the detection engineering standard— author, tune, and peer‑review detections in KQL, SPL, EQL, or Sigma; manage the false‑positive backlog; map coverage to MITRE ATT&CK; and train L1/L2 analysts to write and tune detections themselves.
• Own the threat‑landscape narrative for your engagement— turn intelligence from NCSC advisories, sector feeds, and threat actor reporting into hunt themes, coverage gap analysis, and detection priorities that the SOC and client stakeholders can act on.
• Run the intelligence cycle as a managed discipline— maintain a collection plan, produce timely and rigorous intelligence products, and build feedback loops that keep the cycle honest and improving.
• Establish and lead security incident response practice— build playbooks, define the severity model, run exercises, and lead the team’s response to significant incidents; run blameless post‑mortems that the team actually learns from.
• Design the log and telemetry pipeline that detections run on— including bespoke application telemetry in cloud environments, not just commodity endpoint feeds; ensure the right signals are collected, parsed, and retained for both detection and investigation.
• Be the trusted technical interface for client security stakeholders— communicate what the SOC is detecting, investigating, and covering without losing fidelity; surface risks early and honestly, and align the team’s priorities to the client’s risk picture.
• Grow the analysts around you— pair on detection authorship and incident response as a default, set pairing as the team norm, and actively build the capability of L1 and L2 analysts through structured mentoring and coaching so knowledge isn’t concentrated in one person.
• Contribute to the Cyber practice beyond your engagement— feed detection content, runbooks, and lessons learned back into shared practice resources; contribute to analyst assessment and hiring; and engage with public‑sector security communities including NCSC CISP and relevant ISACs.

Skills, knowledge and expertise

We’re looking for someone who holds one of the following, or an equivalent senior cyber operations leadership credential:

• Certified Information Systems Security Professional (CISSP)
• Certified Information Security Manager (CISM)
• CompTIA Advanced Security Practitioner (CASP+)
• Experience leading detection engineering in a SOC or similar environment— including writing and tuning detections in KQL, SPL, EQL, or Sigma, and managing coverage against MITRE ATT&CK
• Experience designing or improving a log and telemetry pipeline, including application‑level telemetry from cloud‑hosted services (AWS is a strong preference at this grade), with an understanding of how to design monitoring for failure modes and degraded states
• Evidence of running the intelligence cycle as a managed discipline— collection planning, production, and feedback— rather than consuming finished intelligence
• Working knowledge of UK government security standards and frameworks, including NCSC CAF Objective C, GovAssure, and OFFICIAL handling requirements
• Experience establishing incident response practice— playbooks, severity models, and exercises— not just responding to individual incidents
• Evidence of growing the technical capability of less experienced analysts through pairing, structured mentoring, or coaching, including setting clear goals and tracking progress over time
• Experience anchoring delivery on client outcomes rather than task completion— challenging the brief where it serves the client and making value visible rather than reporting effort
• Evidence of contributing reusable assets— detection playbooks, runbooks, templates, or accelerators— back into a practice or community, rather than leaving knowledge within a single team

Tools and practices

• Familiarity with SOAR tooling and automation of triage and enrichment workflows
• Experience working in Kanban‑led operating models, including managing triage queues, WIP limits, and class‑of‑service for incidents
• Experience running or contributing to skills‑based technical assessments that evaluate demonstrated capability rather than credentials or years of experience

SC Eligibility

An increasing number of our customers are specifying a minimum of SC (security check) clearance in order to work on their projects. As a result, we’re looking for all successful candidates for this role to have eligibility. Eligibility for SC requires 5 years’ UK residency and 5 year employment history (or back to full‑time education). Please note that if at any point during the interview process it is apparent that you may not be eligible for SC, we won’t be able to progress your application and we will contact you to let you know why.