OT SOC Analyst - Operational Technology

Morson Edge; United Kingdom; Hybrid; GBP 60,000 - 80,000; Full time

Job summary

A leading cybersecurity firm in the UK is seeking an experienced SOC Analyst to respond to high-severity cyber incidents. The role includes threat hunting, policy creation, and incident management in a hybrid work environment. Ideal candidates will have extensive SOC and CSIRT experience, particularly in critical infrastructure. A passion for cybersecurity and a proactive mindset are essential.

Qualifications

• Extensive experience in leading cyber incident responses.
• Strong background in SOC and CSIRT operations.
• Experience in CNI and defence environments.

Responsibilities

• Analyse intel and IOCs to find and remove threats.
• Create SOC policies and procedures.
• Manage high-severity incident responses.
• Develop automated workflows for detection.
• Perform forensic analysis and recommend actions.
• Participate in cyber-attack simulations.
• Enhance reporting dashboards and metrics.

Skills

Cyber Incident Leadership Experience

SOC L3 / CSIRT L3 Experience

CNI / Defence / Business Critical Environment Experience

Threat Hunting Experience

Threat Hunting Strategy Mindset

Runbook & Playbook Authoring

Root Cause Analysis

Experience with security monitoring tooling

IT/OT Systems Experience

CNI & OT Environment Awareness

Education

Cyber and OT Certification

Job description

OT SOC Analyst (Operational Technology)

Outside IR35

Duration: 6 9 months

Location: Crawley, Hybrid 2 days per week on site

Overview of project:

The role of an Incident Response (CSIRT) / Security Operations Centre (SOC) Level 3 Analyst is to respond to high–severity cyber security incidents and/or escalated events and alerts then, using experience combined with industry tools and techniques, expediate a containment, eradication and recovery strategy to minimise business impact and ensure UK Power Networks (UKPN) network systems and customer data are protected from cyber threats.

Overview of role and responsibilities:

• Threat Hunting: Analyse intel and IOCs to find and remove hidden threats across UKPN's OT/IT environments.
• Policy: Create SOC policies, standards and procedures aligned with best practice.
• Logs: Ensure all logs feed into the SIEM and build use cases to detect anomalous activity.
• Incident Response: Lead high–severity incidents, improve playbooks and manage remediation, communication and reporting.
• SOAR: Develop automated workflows to streamline detection, enrichment and response.
• Forensics: Perform forensic analysis across multiple data sources and recommend containment and eradication actions.
• Crisis Testing: Take part in cyber–attack simulations to strengthen resilience.
• Reporting: Improve reporting dashboards and key security metrics.
• Tooling: Support and maintain security tools and platforms for threat prevention, detection and response.
• Audit: Support SOC2/NCSC CAF/ISO27001 audits and ensure compliance.
• Continuous Improvement: Automate and enhance monitoring, detection and response based on evolving threats.

Skills, experience and previous achievements required:

Essential

• Extensive End to End Cyber Incident Leadership Experience
• Extensive SOC L3 / CSIRT L3 Experience
• Extensive CNI / Defence / Business Critical Environment Experience

Desirable

• Threat Hunting Experience
• Threat Hunting Strategy Mindset
• Runbook & Playbook Authoring
• Lessons Learned / Root Cause Analysis Leader
• Experience working with and enhancing security monitoring tooling
• Extensive IT/OT Systems Experience
• Extensive CNI & OT Environment Awareness
• Experience aligning with organisational requirements and contributing to audit readiness

Tickets/Qualifications/Accreditations required to carry out the role:

• Desirable – Cyber and OT Certification

Previous companies of interest:

• MOD or similar