Lead SOC Analyst

Anson McCade; Greater London; On-site; GBP 70,000 - 100,000; Full time

Job summary

Anson McCade is partnering with a world-leading Technology Services firm to build a high-performance Security Operations capability in the UK. We are seeking an experienced Lead SOC Analyst / L3 SOC Analyst who will lead complex incidents and drive containment, eradication and recovery across SIEM and EDR platforms.

You will escalate, investigate attack vectors and help shape detection capabilities and playbooks, mentoring junior analysts and participating in SOC exercises.

Qualifications

• 3+ years of experience across SOC, incident response or threat analysis.
• Hands-on experience with SIEM/EDR platforms.
• Good understanding of malware behaviour and incident handling.
• Strong analytical and investigative skills.
• Experience handling escalated or high-severity incidents.
• Certifications such as GCIH, GCIA, CySA+, SC-200 or Splunk are advantageous but not essential.

Responsibilities

• Lead investigations into medium and high-severity incidents.
• Perform root cause analysis and build detailed incident narratives.
• Work extensively with SIEM and EDR tooling.
• Support containment, eradication and recovery activities.
• Identify gaps in detection coverage and playbooks.
• Tune detection rules and thresholds with Security Content Engineers.
• Mentor L1 SOC Analysts with technical guidance.
• Participate in SOC exercises and simulated Incident Response scenarios.

Skills

SOC operations

Incident response

Threat analysis

Analytical skills

Tools

SIEM

EDR

Job description

I’m working with one of the world's largest Technology Services firms as they build out a new high-performance Security Operations capability supporting some of the UK’s most advanced, secure and next-generation compute infrastructure.

We’re looking for an experienced Lead SOC Analyst / L3 SOC Analyst who enjoys being hands‑on with complex security incidents and wants to work at the sharp end of Incident Response, Threat Analysis and Security Operations.

This isn’t just alert monitoring.

You’ll act as an escalation point for complex and high‑severity incidents, investigating attack vectors and impact, correlating activity across multiple data sources and helping drive incidents through containment, eradication and recovery.

What you’ll be doing:

• Leading investigations into medium and high‑severity security incidents
• Performing root cause analysis and building detailed incident narratives
• Working extensively with SIEM and EDR tooling
• Supporting containment, eradication and recovery activities
• Identifying gaps in detection coverage and existing playbooks
• Tuning detection rules and thresholds alongside Security Content Engineers
• Mentoring and providing technical guidance to L1 SOC Analysts
• Taking part in SOC exercises and simulated Incident Response scenarios

What we’re looking for:

• 3+ years’ experience across SOC, Incident Response or Threat Analysis
• Strong hands‑on experience with SIEM / EDR platforms
• Good understanding of malware behaviour and incident handling methodologies
• Strong analytical and investigative skills
• Experience handling escalated or high‑severity incidents
• Certifications such as GCIH, GCIA, CompTIA CySA+, Microsoft SC-200 or Splunk are advantageous, but not essential.

Salary & benefits

• Competitive salary + package + shift premium

Due to the sensitive nature of the programme, candidates will need to satisfy specific BPSS and security clearance requirements, including the required UK residency/address history and nationality criteria.

#CyberSecurity #SOC #SecurityOperations #IncidentResponse #ThreatDetection #SIEM #EDR #CyberJobs #LondonJobs