OT SOC Analyst - Operational Technology

Morson Edge; Pulborough; Hybrid; GBP 60,000 - 85,000; Full time

Job summary

A leading technology service provider in the UK is seeking an experienced OT SOC Analyst to handle high-severity cyber security incidents. You will analyze threats, create SOC policies, lead incident response, and enhance security monitoring. The ideal candidate has extensive experience in leadership roles within critical environments. This position offers a hybrid work model with 2 days on-site in Crawley.

Responsibilities

• Analyze intel and IOCs to find threats across environments.
• Create SOC policies and procedures aligned with best practice.
• Ensure all logs feed into the SIEM and detect anomalous activity.
• Lead high-severity incidents, improving playbooks and manage remediation.
• Develop automated workflows to streamline response.
• Perform forensic analysis and recommend containment actions.
• Participate in cyber-attack simulations to strengthen resilience.
• Improve reporting dashboards and key security metrics.
• Support and maintain security tools and platforms.
• Support audits and ensure compliance.
• Automate and enhance detection and response.

Skills

End to End Cyber Incident Leadership Experience

SOC L3 / CSIRT L3 Experience

CNI / Defence / Business Critical Environment Experience

Threat Hunting Experience

Threat Hunting Strategy Mindset

Runbook & Playbook Authoring

Lessons Learned / Root Cause Analysis Leadership

Experience working with security monitoring tooling

Extensive IT/OT Systems Experience

Extensive CNI & OT Environment Awareness

Education

Cyber and OT Certification

Job description

OT SOC Analyst (Operational Technology)

Outside IR35

Duration: 6 - 9 months

Location: Crawley, Hybrid 2 days per week on site

Overview of project

The role of an Incident Response (CSIRT) / Security Operations Centre (SOC) Level 3 Analyst is to respond to high‑severity cyber security incidents and/or escalated events and alerts then, using experience combined with industry tools and techniques, expedite a containment, eradication and recovery strategy to minimise business impact and ensure UK Power Networks (UKPN) network systems and customer data are protected from cyber threats.

Overview of role and responsibilities

• Threat Hunting: Analyse intel and IOCs to find and remove hidden threats across UKPN's OT/IT environments.
• Policy: Create SOC policies, standards and procedures aligned with best practice.
• Logs: Ensure all logs feed into the SIEM and build use cases to detect anomalous activity.
• Incident Response: Lead high‑severity incidents, improve playbooks and manage remediation, communication and reporting.
• SOAR: Develop automated workflows to streamline detection, enrichment and response.
• Forensics: Perform forensic analysis across multiple data sources and recommend containment and eradication actions.
• Crisis Testing: Take part in cyber‑attack simulations to strengthen resilience.
• Reporting: Improve reporting dashboards and key security metrics.
• Tooling: Support and maintain security tools and platforms for threat prevention, detection and response.
• Audit: Support SOC2/NCSC CAF/ISO27001 audits and ensure compliance.
• Continuous Improvement: Automate and enhance monitoring, detection and response based on evolving threats.

Skills, experience and previous achievements required

• Essential
  • Extensive End to End Cyber Incident Leadership Experience
  • Extensive SOC L3 / CSIRT L3 Experience
  • Extensive CNI / Defence / Business Critical Environment Experience
• Desirable
  • Threat Hunting Experience
  • Threat Hunting Strategy Mindset
  • Runbook & Playbook Authoring
  • Lessons Learned / Root Cause Analysis Leader
  • Experience working with and enhancing security monitoring tooling
  • Extensive IT/OT Systems Experience
  • Extensive CNI & OT Environment Awareness
  • Experience aligning with organisational requirements and contributing to audit readiness

Tickets/Qualifications/Accreditations required to carry out the role

• Desirable - Cyber and OT Certification

Previous companies of interest

MOD or similar