SC Cleared SOC Analyst: Sentinel & MITRE Detection

SCC; United Kingdom; On-site; GBP 60,000 - 90,000; Full time

Job summary

SCC is seeking an experienced SOC Analyst (SC Cleared) with strong Microsoft Sentinel expertise to support advanced threat detection within a complex enterprise security environment. You will design, build, and optimise Sentinel detections and analytics rules across cloud and on-prem environments, while reducing false positives and improving detection fidelity.

Key duties include developing KQL queries, automation playbooks, and collaborating with SOC and Incident Response teams to enhance

Qualifications

• Active SC Clearance required.
• Advanced KQL development skills required.
• Deep understanding of MITRE ATT&CK and detection engineering.
• Experience with cloud, endpoint, identity and network integrations.
• Knowledge of Sentinel Automation Rules, Playbooks and Logic Apps.
• Excellent stakeholder engagement and documentation skills.

Responsibilities

• Design, develop and optimise Microsoft Sentinel detections and Analytics Rules.
• Create advanced KQL queries aligned to MITRE ATT&CK techniques.
• Build detections across cloud, endpoint, identity and network environments.
• Tune alerts, reduce false positives and improve detection fidelity.
• Develop Sentinel automation, Playbooks and Logic Apps.
• Produce technical documentation and operational handover materials.
• Collaborate with SOC, Incident Response and Security teams to improve threat visibility.

Skills

KQL development

MITRE ATT&CK

Azure/Microsoft 365/AWS

Dynatrace & ServiceNow

Sentinel automation

Playbooks & Logic Apps

Stakeholder engagement

Documentation

Tools

Azure

Microsoft 365

AWS

Dynatrace

ServiceNow

Job description

SCC is seeking an experienced SOC Analyst (SC Cleared) with strong Microsoft Sentinel expertise to support advanced threat detection within a complex enterprise security environment. You will design, build, and optimise Sentinel detections and analytics rules across cloud and on-prem environments, while reducing false positives and improving detection fidelity.

Key duties include developing KQL queries, automation playbooks, and collaborating with SOC and Incident Response teams to enhance