Security Operation Centre (SOC) Analyst

Civil Aviation Authority; Guildford; Hybrid; GBP 23,000 - 38,000; Part time

Benefits offered by this job

Flexible & hybrid working

28 days annual leave + holidays

Pension scheme

Wellbeing room

Mental health support

Employee assistance programme

Gym access at Gatwick

EV charging points

Internal training

Job summary

The Civil Aviation Authority (CAA) is seeking a SOC Analyst to join our new Security Operations Centre at Gatwick. You will monitor, triage and investigate security events to protect critical aviation systems and data in real time.

This fixed-term role (12-18 months) offers hybrid working, a salary up to £38,000, and the chance to develop expertise in SIEM, EDR and incident response within a regulated environment.

Qualifications

• Experience in a SOC, threat detection, or security operations environment.
• Familiar with incident response processes and evidence handling.
• Knowledge of SIEM/EDR platforms (Microsoft Sentinel/Defender).
• Understanding of Windows, Active Directory, and basic networking concepts.
• CompTIA Security+ or equivalent foundational knowledge.
• Strong communication and collaboration skills during investigations.

Responsibilities

• Monitor, triage and investigate security events in a SOC.
• Investigate incidents impacting operations, systems, or data.
• Support continuous improvement of security monitoring and response capabilities.

Skills

SOC experience

SIEM (Sentinel)

EDR

Windows AD

Incident response

IOCs

Communication

Collaboration

Tools

Microsoft Sentinel

Defender

PowerShell

Logic Apps

Azure

Job description

Salary: Up to £38,000 - (dependent on experience)

Contract Type: Fixed Term Contract - (12 - 18 months)

Location: Gatwick - Hybrid

Closing Date: Friday 9th October 2026

Interview Date: w/c 19th October 2026

Visa Restrictions: This position does not offer visa sponsorship.

We are the UK's aviation and aerospace regulator and recognised as a world leader in its field. Our activities are diverse, enabling the aviation industry to meet the highest safety standards, and we pride ourselves on our ability to adapt to the constantly evolving aviation environment.

The Role

With the establishment of a dedicated Security Operations Centre (SOC) at the CAA in early 2026, we are entering a transformative phase in our cyber defence capability. This strategic initiative marks a significant investment in strengthening our ability to detect, respond to, and recover from cyber threats in real time. SOC Analysts are responsible for monitoring, triaging, and investigating security events that could impact the CAA's operations, systems, or data. Working as part of an in-house SOC, the role focuses on first and second-line defence activities and supports continuous improvement to our security monitoring and response capabilities.

Core Accountabilities

Working in a team of analysts, the SOC Analyst is expected to handle investigations with autonomy and good judgment. This is an excellent opportunity for someone with prior SOC experience to develop their technical depth while contributing to a fast-moving and maturing security function.

About You

• Experience in a SOC, threat detection, or security operations environment
• Working knowledge of SIEM and EDR platforms (especially Microsoft Sentinel and Defender)
• Working understanding of Windows, Active Directory, and basic networking concepts
• Familiarity with the incident response process and evidence handling
• Analytical mindset and strong attention to detail in order to identify indicators of compromise (IOCs)
• Ability to work under pressure and manage multiple investigations
• CompTIA Security+ certification or equivalent foundational knowledge
• Strong communication and collaboration skills to effectively work with IT, network, and application teams during investigations

Desirable skills for the role

• Experience using KQL (Kusto Query Language) for writing or modifying queries withing Microsoft Sentinel
• Exposure to PowerShell, Logic Apps or scripting languages for automation and investigative tasks
• Understanding of MITRE ATT&CK or other threat models
• Knowledge of threat intelligence concepts and IOCs
• Experience with cloud environments, particularly Microsoft Azure
• Relevant certifications (e.g. SC-200, CySA+, or equivalent)

Additional Information

For many appointments within the CAA, these roles require access to operationally sensitive infrastructure and/or Nationally Protected information. For these roles the post holders must undergo National Security Vetting and achieve the appropriate level of clearance.

SC - To be vetted we will usually expect a reasonable period of residency in the UK so that meaningful checks can be undertaken. For this role this will need to be 5 years.

If you do not meet these requirements, we may not be able to accept your application.

For more information on CTC and SC clearance please visit - Vetting explained - GOV.UK (www.gov.uk)

The CAA values high ethical standards and personal integrity among employees. If invited for interview you will be asked to complete a declaration of interest.

Relocation & Property

The CAA will be relocating from Aviation House (Our Gatwick Office) to new premises in a few years' time. Our move is driven by strategic, operational and environmental considerations.

We will be moving to a new local home, up to a 15-mile radius of Aviation House, to minimise disruption for our valued colleagues and customers.

We are now working with colleagues and visitors to understand what we need in our new office, before we start our property search. We will sell Aviation House and land, vacate the site and move to new premises, but we do not expect to move before 2028.

Inclusivity

We are proud to be an equal opportunity employer and celebrate our diversity ensuring all are backgrounds included here at the CAA. As a member of the Disability Confident scheme, applicants who meet the minimum criteria for a role with us will be guaranteed an interview.

Our Benefits

• Flexible & hybrid working arrangements available
• 28 days annual leave + public holidays (additional 5 days leave purchase scheme)
• Generous pension scheme (Up to 12% employer contribution)
• Wellbeing Room at Gatwick
• Mental Health and Suicide First Aiders
• Employee Assistance Programme, talking therapies and neurodiversity support via Occupational Health & access to Headspace for colleagues and 5 dependents
• Free onsite gym at Gatwick or discounted gym membership for London
• EV charging points
• Employee Development courses internally and via Skillsoft

Our Values

Do The Right Thing, Never Stop Learning, Build Collaborative Relationships, Respect Everyone - For more information please Click Here