SecOps Engineer

OCS; City Of London; On-site; GBP 70,000 - 95,000; Full time

Benefits offered by this job

Award-Winning Employer

Digital Learning

Retail Discounts

Professional Growth

Flexible Pay

Job summary

OCS UK & Ireland is seeking a proactive Security Operations Analyst to strengthen our cyber defence capability. You will drive improvements in detection, investigation and response across SIEM, EDR and email security, reducing friction for analysts and increasing effectiveness.

You will own detection engineering, automation and platform health, performing threat hunts and incident support while documenting runbooks and standards for knowledge sharing across the SecOps team.

Qualifications

• Extensive SecOps experience with multiple tools.
• Hands-on security engineer or senior SOC analyst with engineering responsibilities.
• Strong knowledge of at least one enterprise SIEM and one EDR/XDR platform.
• Scripting ability in Python, PowerShell or KQL; APIs and integrations.
• Understanding of MITRE ATT&CK and telemetry.
• Proactive mindset with evidence of end-to-end problem solving.
• Clear written documentation of detections and runbooks.

Responsibilities

• Build, test and tune SIEM/XDR/email detections mapped to MITRE ATT&CK.
• Develop automation to remove repetitive tasks using SOAR, scripting or low-code.
• Maintain configuration health and onboarding of new log sources.
• Conduct threat hunts and translate findings into detections or processes.
• Provide technical support during significant incidents and capture lessons.
• Maintain backlog and document standards and runbooks.

Skills

SIEM

EDR/XDR

Python

PowerShell

KQL

APIs

CI/CD

SOAR

MITRE ATT&CK

Detections tuning

Communication

Tools

SOAR

CI/CD

Dashboarding

APIs

Job description

About The Role:

The Security Operations Analyst plays a central role in strengthening OCS’s cyber defence capability.

The role exists to make our SecOps function measurably more effective every quarter, by improving how we detect, investigate and respond to threats, and by removing the friction that holds analysts back.

We are looking for a proactive engineer who does not wait to be told where the problems are. The successful candidate will actively look for weaknesses in our detection coverage, configuration drift in our security platforms, gaps in our automation and inefficiencies in our processes. They will then propose pragmatic fixes, build them, and measure the outcome

Main Duties & Responsibilities of the Role

Detection engineering and tuning

• Build, test and maintain high-quality detections across our SIEM, XDR and email security platforms, mapped to the MITRE ATT&CK framework
• Continuously tune existing detections to reduce false positives and improve fidelity, using a data-driven approach
• Identify gaps in detection coverage proactively and propose engineering work to close them
• Develop and maintain detection-as-code practices, including version control, peer review and CI/CD where appropriate

Automation and tooling

• Identify repetitive analyst tasks and engineer automation to remove them, using SOAR, native platform automation, scripting or low-code approaches
• Build and maintain integrations between security tools and adjacent platforms such as identity, endpoint management and ticketing
• Develop and maintain dashboards that give analysts and leadership a clear view of operational health

Platform health and configuration

• Own the configuration and ongoing health of assigned SecOps platforms, including SIEM, EDR, email security and identity protection
• Monitor for configuration drift, agent coverage gaps and ingestion failures, and resolve them at source
• Lead technical onboarding of new log sources, telemetry and integrations, ensuring that data is usable, normalised and well documented

Threat hunting and proactive defence

• Conduct regular threat hunts based on intelligence, recent incidents and known weaknesses, documenting hypotheses, methodology and findings
• Translate hunt findings into durable detections, automation or process changes
• Contribute to purple team exercises and adversary emulation, working with internal and external partners

Incident response support

• Provide deep technical support during significant incidents, including forensic data collection, log analysis and containment engineering
• Capture lessons learned from incidents and translate them into engineering improvements that prevent recurrence

Continuous improvement

• Maintain a backlog of identified weaknesses, ideas and improvements, and work with the Senior SecOps Lead to prioritise it
• Document standards, runbooks and engineering decisions clearly, so that knowledge does not live only in individual heads
• Stay current with the threat landscape, vendor road maps and the broader security engineering community, and bring relevant ideas back into OCS

Professional Qualifications required for the job (particularly for compliance purposes or technical requirements of the role)

Extensive SecOps experience with a multitude of different tools

• Demonstrable hands-on experience as a security engineer or senior SOC analyst with engineering responsibilities
• Strong working knowledge of at least one enterprise SIEM and one EDR or XDR platform, with the ability to write detections, tune content and operate at a deep technical level
• Solid scripting ability, for example in Python, PowerShell or KQL, with a working understanding of APIs and integration patterns
• Practical understanding of common attack techniques mapped to MITRE ATT&CK, and how they manifest in telemetry
• A proactive mindset: the candidate must be able to point to specific examples where they have identified a problem, designed a solution and delivered it end to end
• Strong written communication, including the ability to document detections, runbooks and engineering decisions to a high standard

Relevant Industry Certifications

Experience -previous experience -desirable/essential for technical competence of the role

Personal Characteristics/Attributes

• Organisational and time management skills
• Strong interpersonal skills
• Exceptional written and verbal communication skills
• Ability to work under own initiative, as well as part of a team
• Willingness and ability to undertake national travel as required
• Confidence to stand their ground and drive a Security First environment
• The ability to learn new tools quickly and effectively

About The Company:

OCS UK & Ireland is a leading facilities management company with 50,000+ colleagues and a turnover in excess of £2bn. We deliver innovative, award-winning services within facilities management, hard services, cleaning, security and catering.

Our mission is to make people and places the best they can be for our colleagues, customers and the communities we serve. Our commitment to doing business the right way is rooted in our TRUE values - Trust, Respect, Unity, and Empowerment.

Why Work for OCS?

• Award-Winning Employer: Ranked 36th on Glassdoor’s Best Companies to Work For 2025 - we value and motivate our people.
• Digital Learning: The OCS Academy offers digital courses and resources to help you build skills and grow your career.
• Retail Perks: With our Hapi app, you can gain access to exclusive discounts, rewards and wellbeing resources.
• Professional Growth: 600+ live learners across UK&I - Empowering colleagues with further development and qualifications!
• Flexible Pay: Access a portion of earned wages before payday with our Wagestream App! (Contract Specific)

We are an equal opportunities employer and rely on a diverse workforce with a broad range of knowledge, skills, and backgrounds to deliver our goals. We offer an inclusive and welcoming environment and actively encourage applications from all individuals regardless of race, gender, nationality, religion, sexual orientation, disability, or age.