Lead SOC Security Analyst – Hybrid (3 Onsite/2 Remote)

Global Technology Solutions Ltd; Reading; Hybrid; GBP 60,000 - 80,000; Full time

Benefits offered by this job

25 days holiday

Holiday trading

Volunteer day

Pension

Life assurance

Employee assistance

Mentoring

Eye care

flu vaccination

Costco eligibility

Job summary

Global Technology Solutions Ltd in Reading is seeking an experienced SOC engineer to lead serious incidents, perform forensic investigations, and develop detections and automation.

You will mentor colleagues, support Microsoft 365, Azure, AWS security, and work in a hybrid model with three office days and two remote days.

Strong hands-on experience with Sentinel, Defender XDR and CrowdStrike, plus proficiency in KQL and PowerShell/Python, is essential.

Qualifications

• Substantial SOC, cyber operations or security engineering experience.
• Hands-on Sentinel, Defender XDR and CrowdStrike expertise.
• Incident response, malware analysis, forensics and threat hunting.
• Advanced KQL; PowerShell and/or Python automation.
• Entra ID, Conditional Access, Intune and Microsoft 365 security.
• Cloud and networking knowledge; MITRE ATT&CK, NIST and SANS frameworks.
• CISSP desirable.

Responsibilities

• Lead serious incidents, forensic investigations and root cause analysis.
• Develop detections, automation and orchestration; conduct proactive threat hunting.
• Engineer Sentinel, Defender XDR, CrowdStrike Falcon, Entra ID, Intune and Darktrace.
• Support Microsoft 365, Azure, AWS, identity and endpoint security.
• Maintain documentation, support compliance and mentor colleagues.

Skills

SOC operations

Incident response

Threat hunting

PowerShell

Python

KQL

Automation

Education

CISSP certification

Tools

Sentinel

Defender XDR

CrowdStrike Falcon

Entra ID

Intune

Darktrace

Job description

Global Technology Solutions Ltd in Reading is seeking an experienced SOC engineer to lead serious incidents, perform forensic investigations, and develop detections and automation.

You will mentor colleagues, support Microsoft 365, Azure, AWS security, and work in a hybrid model with three office days and two remote days.

Strong hands-on experience with Sentinel, Defender XDR and CrowdStrike, plus proficiency in KQL and PowerShell/Python, is essential.