Security Operations Center Analyst

TechNET; United Kingdom; Remote; GBP 65,000 - 92,000; Full time

Job summary

TechNET is urgently seeking two experienced Cyber Incident Response / SOC Analysts to support a UK-based security operations team. The role focuses on security alert monitoring, incident investigation, phishing triage and threat response, with an initial 4-week contract and UK remote working after onboarding.

The team is looking for L1/L2 SOC/CIRT analysts with strong Microsoft Defender and Sentinel experience; L3s are also welcome for short-term engagements.

Qualifications

• 3-5 years' experience in a Cyber Incident Response Team (CIRT) or Security Operations Centre (SOC)
• Hands-on experience with Microsoft Defender for alert investigation and response
• Operational experience with Microsoft Sentinel SIEM for alert triage and investigation
• Experience using Cisco Umbrella for security monitoring and threat protection
• Familiarity with Infosec IQ and Abnormal Security platforms
• Experience responding to threat intelligence alerts and indicators of compromise

Responsibilities

• Monitor, triage and investigate security alerts from Defender and Sentinel.
• Investigate and respond to potential cyber incidents and remediation actions.
• Triage and investigate phishing emails, identify malicious links and IOCs.
• Review threat intelligence reports and assess risks to the organisation.
• Contain incidents with user and device isolation when needed.
• Escalate complex or high-severity incidents through case management.
• Maintain accurate incident records and actions taken.
• Support the wider security operations team for incident response and continuity.

Skills

Microsoft Defender

Microsoft Defender SIEM

Microsoft Sentinel

Phishing analysis

Threat intelligence

Incident response

SOC operations

Tools

Cisco Umbrella

Infosec IQ

Abnormal Security

Job description

Contract | 2 Positions | Immediate Start | UK Remote

Location: UK - Remote following initial onboarding and equipment collection

Contract Duration: Initial 4 weeks, potential extension

IR35 Status: Inside IR35

Start Date: Immediate

Day Rate: Competitive, dependent on experience

The Opportunity

We are urgently seeking two experienced Cyber Incident Response / Security Operations Centre (SOC) Analysts to support an established UK-based security operations team within a global organisation.

This is a hands-on, operational role focused on security alert monitoring, incident investigation, phishing triage and threat response.

The successful candidates will join an existing team to provide immediate operational support during a short-term period of increased demand.

We are particularly interested in L1 and L2 SOC/CIRT Analysts with strong Microsoft security technology experience, although L3 analysts available for short-term engagements are also encouraged to apply.

Key Responsibilities

• Monitor, triage and investigate security alerts generated through Microsoft Defender and Microsoft Sentinel SIEM.
• Investigate and respond to potential cyber incidents, identifying threats and determining appropriate remediation actions.
• Triage and investigate reported phishing emails, including identifying malicious links, attachments and indicators of compromise.
• Review and respond to threat intelligence reports, assessing potential risks to the organisation.
• Perform initial incident containment activities, including user account isolation and device isolation where required.
• Escalate complex or high-severity incidents to senior security analysts through established case management processes.
• Maintain accurate incident records, investigation findings and actions taken.
• Support the wider security operations team in maintaining effective incident response and operational continuity.
• 3-5 years' experience working within a Cyber Incident Response Team (CIRT), Security Operations Centre (SOC) or equivalent security operations environment.
• Strong hands-on experience with Microsoft Defender, including security alert investigation and response.
• Direct operational experience with Microsoft Sentinel SIEM, including alert triage and incident investigation.
• Experience using Cisco Umbrella for security monitoring, investigation and threat protection.
• Proven experience investigating phishing emails and responding to email security threats.
• Familiarity with Infosec IQ and Abnormal Security platforms.
• Experience responding to threat intelligence alerts and identifying indicators of compromise.
• Ability to undertake account and device isolation activities as part of incident containment.
• Understanding of incident management, escalation procedures and security operations best practices.
• Ability to work independently and contribute effectively from day one, with minimal onboarding.
• Previous experience supporting global security operations environments.
• Experience working across L1, L2 or L3 SOC/CIRT functions.
• Exposure to Microsoft 365 security environments and identity-related security incidents.
• Experience supporting high-volume alert queues and managing multiple investigations simultaneously.
• Previous experience delivering short-term contract assignments within established security teams.

This is an urgent requirement for two immediately available contractors to provide short-term operational cover.

The initial engagement will be4 weeks, making it particularly suitable for experienced SOC/CIRT contractors between assignments or those seeking a short-term engagement.

Candidates must be UK-based and available to complete initial onboarding and equipment collection before working remotely.