Security Operations Center Analyst

Covenant HR LLC; Greater London; On-site; GBP 90,000 - 120,000; Full time

Job summary

Our client in Barbican, London, is seeking a Senior SOC Analyst to join a high‑velocity threat response team. The role is onsite with a contract through March 2027 and requires rapid incident detection, triage, and remediation across cloud, Linux and macOS environments, including containers.

You will lead investigations, develop automated workflows, and collaborate across Threat Hunting, Forensics, Legal, and Infra teams to evict attacks and prevent recurrence.

Qualifications

• 5+ years of direct, high-severity incident response experience, including triage and remediation.
• Senior SOC/IR experience with ability to hit the ground running and manage tickets.
• Hands-on SOC background focused on day-to-day threat detection and response.
• Experience across macOS, Linux/cloud environments, and containers with forensics skills.
• AI/automation experience and familiarity with security tooling like Splunk.

Responsibilities

• Provide hands-on SOC and IR support, owning active tickets amid high caseloads.
• Triage, investigate, and remediate high-severity incidents across a global tech stack.
• Operate independently during ambiguous, high-pressure incidents and breaches.
• Develop and tune alerts to identify anomalous activity across environments.
• Conduct root-cause analysis and drive remediation and improvements.
• Investigate Linux/cloud infra, macOS endpoints, containers, and microservices.
• Utilize Splunk and AI-driven tooling to support detection and response.
• Build automation workflows to improve SOC efficiency and response times.
• Collaborate with Threat Hunting, Threat Intelligence, Forensics, Legal, and Infra.

Skills

Incident response

SOC operations

Threat detection

Autonomous work under pressure

Tools

Splunk

Docker

Kubernetes

Job description

Company - Our client supports the security operations of a global social media organization operating a large-scale, cloud-centric technology environment. The organization manages complex infrastructure spanning cloud platforms, Linux systems, containers/microservices, and macOS endpoints, with a strong focus on responding to rapidly evolving and AI-driven cyber threats.

Job Title - Senior SOC Analyst - (2 Openings)

Location - Onsite in Barbican, London, UK

Role Type - Contract through March 2027, with an ASAP start

Schedule:

• 1 analyst: Sunday–Wednesday, 06:00–16:00 UK time
• 1 analyst: Wednesday–Saturday, 06:00–16:00 UK time

Must Have Skills:

• 5+ years of direct, high-severity incident response experience, including independently triaging, investigating, managing, and remediating complex security incidents and active breaches
• Senior, hands-on SOC/Incident Response experience with the ability to hit the ground running, manage operational caseload, and actively work and resolve tickets
• Strong operational SOC background focused primarily on day-to-day threat detection, triage, investigation, and incident response
• Strong hands-on experience across at least 2 of the following: macOS endpoints, Linux/cloud environments, and microservices/containers, with deep Linux/Unix command-line and cloud/container forensics skills
• Practical AI/automation experience, including AI-driven or agentic security tooling and building scripts/workflows that improve SOC triage and response; Splunk experience strongly relevant

Responsibilities and Job Details:

• Provide hands-on operational SOC and Incident Response support, taking ownership of active tickets and helping absorb a high-volume security caseload
• Triage, investigate, manage, and remediate high-severity security incidents across a complex global technology environment
• Operate independently during ambiguous, high-pressure incidents and complex active breaches without requiring prescriptive direction
• Develop and tune alerts to identify anomalous and malicious activity across the environment
• Conduct comprehensive investigations and root-cause analysis while helping drive attack eviction, remediation, recovery, and post-incident improvements
• Perform investigations across Linux/cloud infrastructure, macOS endpoints, containers, and microservices, including Docker, Kubernetes, and container runtime logs
• Use Splunk and emerging AI-driven security tooling, including 7AI, to support detection, investigation, triage, and response
• Build automation workflows and scripts that improve SOC efficiency and accelerate security triage and incident response
• Collaborate cross-functionally with Threat Hunting, Cyber Threat Intelligence, Digital Forensics, Legal, Infrastructure, and other teams
• Lead deep, complex investigations involving disparate data sources and stakeholders across multiple regions
• Work approximately four 10-hour onsite shifts per week, with openings for Sunday–Wednesday or Wednesday–Saturday, 06:00–16:00 UK time; candidates should specify which shift they can support