Lead SOC Analyst | Hybrid, Cardiff

The Opportunity Hub UK Ltd; Cardiff; Hybrid; GBP 48,000 - 57,000; Full time

Benefits offered by this job

Private medical insurance

Pension contribution

Generous annual leave

Flexible working

Job summary

The Opportunity Hub UK Ltd in Cardiff is seeking a Lead SOC Analyst to own the operational rhythm of the SOC, mentor analysts, and make critical decisions when incidents occur. You will lead day-to-day operations, coordinate incident response, and drive improvements in detection and response capabilities.

The role requires hands-on SIEM (Splunk/Sentinel/QRadar) and EDR experience, threat intelligence knowledge, and a proven ability to lead teams.

Qualifications

• Solid hands-on experience with SIEM platforms (Splunk, Sentinel, QRadar or similar) and EDR tools.
• Working grasp of threat intelligence, MITRE ATT&CK, and incident response frameworks.
• Proven ability to lead or mentor junior analysts, not just supervise them.
• Calm decision-making under pressure; incidents don’t wait for a good moment.

Responsibilities

• Leading day-to-day SOC operations, triaging and escalating security incidents across the monitored estate.
• Mentoring Tier 1 and Tier 2 analysts, reviewing investigations and sharpening detection logic.
• Running root cause analysis on confirmed incidents and writing up findings for clients and internal stakeholders.
• Tuning SIEM rules and playbooks to improve detection and reduce false positives.
• Coordinating incident response during active threats, from containment through lessons learned.
• Reporting on SOC performance and threat trends to senior management on a regular cycle.

Skills

SIEM experience

EDR tools

Threat intelligence

Incident response

Leadership / mentoring

Written communication

Education

CISSP or equivalent certification

Tools

Splunk

Sentinel

QRadar

Job description

The Opportunity Hub UK Ltd in Cardiff is seeking a Lead SOC Analyst to own the operational rhythm of the SOC, mentor analysts, and make critical decisions when incidents occur. You will lead day-to-day operations, coordinate incident response, and drive improvements in detection and response capabilities.

The role requires hands-on SIEM (Splunk/Sentinel/QRadar) and EDR experience, threat intelligence knowledge, and a proven ability to lead teams.