Lead SOC Analyst

The Opportunity Hub UK Ltd; Cardiff; Hybrid; GBP 48,000 - 57,000; Full time

Benefits offered by this job

Private medical insurance

Pension contribution

Generous annual leave

Flexible working

Job summary

The Opportunity Hub UK Ltd in Cardiff is seeking a Lead SOC Analyst to own the operational rhythm of the SOC, mentor analysts, and make critical decisions when incidents occur. You will lead day-to-day operations, coordinate incident response, and drive improvements in detection and response capabilities.

The role requires hands-on SIEM (Splunk/Sentinel/QRadar) and EDR experience, threat intelligence knowledge, and a proven ability to lead teams.

Qualifications

• Solid hands-on experience with SIEM platforms (Splunk, Sentinel, QRadar or similar) and EDR tools.
• Working grasp of threat intelligence, MITRE ATT&CK, and incident response frameworks.
• Proven ability to lead or mentor junior analysts, not just supervise them.
• Calm decision-making under pressure; incidents don’t wait for a good moment.

Responsibilities

• Leading day-to-day SOC operations, triaging and escalating security incidents across the monitored estate.
• Mentoring Tier 1 and Tier 2 analysts, reviewing investigations and sharpening detection logic.
• Running root cause analysis on confirmed incidents and writing up findings for clients and internal stakeholders.
• Tuning SIEM rules and playbooks to improve detection and reduce false positives.
• Coordinating incident response during active threats, from containment through lessons learned.
• Reporting on SOC performance and threat trends to senior management on a regular cycle.

Skills

SIEM experience

EDR tools

Threat intelligence

Incident response

Leadership / mentoring

Written communication

Education

CISSP or equivalent certification

Tools

Splunk

Sentinel

QRadar

Job description

Join a growing Cybersecurity company as a Lead SOC Analyst in Cardiff.

Threat actors don't take weekends off, and the businesses defending against them need people who can lead under pressure, not just react to it. This Cardiff-based cybersecurity firm has built a reputation for catching what others miss. As the company scales, it needs a Lead SOC Analyst who can sharpen its detection capability and bring structure to a team that's growing fast.

This Lead SOC Analyst role sits at the centre of that effort. You'll own the operational rhythm of the SOC, mentor analysts, and make the calls that matter when an incident lands at 2am.

Here's what you'll be doing:

• Leading day-to-day SOC operations, triaging and escalating security incidents across the monitored estate
• Mentoring Tier 1 and Tier 2 analysts, reviewing their investigations and sharpening detection logic
• Running root cause analysis on confirmed incidents and writing up findings for clients and internal stakeholders
• Tuning SIEM rules and playbooks so the team catches more, faster, with fewer false positives
• Coordinating incident response during active threats, from containment through to lessons learned
• Reporting on SOC performance and threat trends to senior management on a regular cycle

Here are the skills you'll need:

• Solid hands-on experience with SIEM platforms (Splunk, Sentinel, QRadar or similar) and EDR tools
• A working grasp of threat intelligence, MITRE ATT&CK, and incident response frameworks
• Proven ability to lead or mentor junior analysts, not just supervise them
• Calm decision-making under pressure. Incidents don't wait for a good moment
• Strong written communication. You'll need to explain technical findings to people who aren't technical
• A relevant certification (SANS, CISSP, CompTIA Security+ or similar) is a strong plus

Key perks and benefits:

• £48,000 to £57,000 depending on experience, plus bonus scheme
• Hybrid working, based out of Cardiff with flexibility built in
• Private medical insurance and pension contribution
• Generous annual leave and genuinely flexible working, not just a line in the handbook
• Clear progression path within a company that's actively growing, not standing still

Why pursue a career in Cybersecurity?

Cybersecurity isn't slowing down. Every new system, every cloud migration, every remote worker adds another door that needs watching, and the demand for people who can lead a SOC rather than just staff one keeps climbing. Cardiff has quietly become a serious hub for this industry, with a growing cluster of security and tech employers putting down roots there. Good analysts get noticed. Good leaders get promoted.