Lead SOC Analyst - DV Cleared

Network IT; Milton Keynes; On-site; GBP 153,000 - 187,000; Full time

Job summary

Network IT seeks a Lead SOC Analyst to provide operational leadership of the Security Monitoring function in Buckinghamshire. You will ensure timely monitoring, investigation and escalation of cybersecurity events, leading a shift-based team and coordinating with Incident Responders.

The role requires active DV clearance, 12-hour shifts (7am-7pm & 7pm-7am) in a 4-week cycle, and a 6-month contract with ongoing performance reviews.

Qualifications

• Experience in a SOC or similar cybersecurity operations environment.
• Experience leading security monitoring activities and supervising analysts during live service.
• Strong knowledge of SIEM platforms, log analysis and security event investigations.
• Experience handling complex cyber security investigations and escalation paths.
• Good understanding of cyber-attack techniques, indicators of compromise and threat intelligence.
• Mentoring or coaching technical staff in an operational setting.
• Excellent analytical, investigative and communication skills.

Responsibilities

• Lead shift-based delivery of Security Monitoring services, ensuring timely monitoring, investigation, triage and escalation of cybersecurity events.
• Supervise and coordinate a Senior SOC Analyst to meet professional, technical and documentation standards.
• Act as Duty Lead during live cybersecurity events and provide operational decisions.
• Review and quality-assure SOC investigations with evidence-based findings.
• Lead complex investigations before escalation to Incident Response, as delegated by Principal SOC Analyst.
• Coordinate with Incident Responders during incidents and communicate findings and timelines clearly.
• Collaborate with SOC Engineers to improve monitoring coverage and alert quality.
• Support onboarding of new systems and cloud services into SOC monitoring.

Skills

SOC operations

SIEM analysis

Investigation leadership

Mentoring

Threat hunting

Decision making

Documentation

Tools

Microsoft Sentinel

LogRhythm

Job description

Lead SOC Analyst

YOU MUST HAVE ACTIVE DV CLEARANCE

£80 per hour - 42 hour weeks

12 Hour shifts (7am-7pm & 7pm-7am)

7 Days & 7 Nights over a 4-week pattern

6 month contract initially

Buckinghamshire

Summary

The 3x Lead SOC Analysts will be responsible for the operational leadership of the Security Monitoring function, ensuring the consistent delivery of high-quality security monitoring, investigation and escalation activities.

Responsibilities

• Lead theshift-based delivery of Security Monitoring services, ensuring timely and effectivemonitoring, investigation, triage and escalation of cybersecurity events.
• Supervise and coordinate a Senior SOCAnalyst, ensuring investigationsmeet required professional, technicaland documentation standards.
• Act as Duty Lead for Security Monitoring, providing technical leadershipand makingoperational decisions during live cybersecurity events.
• Review and quality-assureSOC investigations, confirming findings are accurate, evidence-based and clearly documented.
• Lead complex and high-priority cyber securityinvestigations before escalation to the IncidentResponse team, as delegated by the Principal SOC Analyst.
• Deliver clear and effectiveshift handovers, maintaining situational awareness and continuity across ongoing investigations and incidents.
• Coordinate with Incident Responders during cyber security incidents,clearly communicating analytical findings, timelines, indicators of compromise and supporting evidence.
• Collaborate with SOC Engineers to improve monitoringcoverage, alert quality and operational effectiveness.
• Support the onboarding of new systems, applicationsand cloud services into SOC monitoringby validating monitoring content and operational readiness.
• Drive continuous improvement across monitoring processes, investigation techniques and analyst efficiency, recommending enhancements to the Principal SOC Analyst.
• Mentor and coach SOC Analysts, supporting their professional developmentand promoting consistent analytical standards andinvestigation best practice.
• Ensure compliance with SOCoperating procedures, security monitoringstandards and information-handling requirements.
• Identify and escalat operational issues, monitoring gaps and emerging threats to the Principal SOC Analyst and SOC Manager.

Required Skills / Experience

• Demonstrable experience working within a SOC or comparable cyber security operations environment.
• Experience leading security monitoring activities and supervising analysts during live operational service.
• Strong knowledge of SIEM platforms, log analysis, security monitoring technologies and security event investigation.
• Experience investigating complex cyber security events and determining appropriate escalation paths.
• Good understanding of cyber-attack techniques, indicators of compromise, threat intelligence and defensive monitoring.
• Experience in mentoring or coaching technical staff within an operational environment.
• Excellent analytical, investigative and problem-solving skills.
• Strong written and verbal communication skills, including the ability to communicate clearly under operational pressure.
• Ability to make timely decisions within a fast-paced 24/7 operational environment.
• Profession certifications such as Microsoft SC-200, GIAC GCIH, GCIA, CompTIA CySA+ or equivalent.

Desirable

• Experience using Microsoft Sentinel, LogRhythm, or equivalent enterprise SIEM platforms.
• Experience developing monitoring improvements, detection tuning, or operational process development.
• Experience supporting Incident Responder activities during major cyber security incidents.
• Experience contributing to the development of monitoring use cases and detection improvements.
• Applied knowledge of MITRE ATT&CK or equivalent adversary behaviour frameworks