Security Operations Specialist

RedCat Digital; Liverpool; Hybrid; GBP 59,000 - 72,000; Full time

Job summary

RedCat Digital is seeking a Security Operations Specialist to act as the 3rd line escalation point for security incidents within a growing SOC. You will diagnose complex issues, implement remediation plans, and collaborate with cross-functional teams to strengthen security across the business.

The role operates in Liverpool on a hybrid basis, with 24/7 monitoring and hands-on investigation. You will work with SIEM, IAM and DLP tooling and engage external partners to ensure effective security

Qualifications

• Proven SOC experience as an analyst or engineer.
• Broad technical understanding across security domains.
• Experience with SIEM, IAM and DLP, ideally in an Azure/M365 environment.
• Experience analysing attacks using frameworks such as MITRE ATT&CK.
• Confident in communicating with technical teams across the business.

Responsibilities

• Lead response to escalated security incidents within SLAs.
• Investigate data to identify underlying problems and reduce false positives.
• Work with external security partners to ensure accurate monitoring and triage.
• Act as technical SME in Cyber Incident Response team.
• Analyze trends in security reporting to improve behaviours.
• Maintain and improve security tooling stack and run phishing campaigns.
• Build relationships with stakeholders across Technology Services.

Skills

SOC experience

Broad technical understanding

SIEM/IAM/DLP

MITRE ATT&CK

Communication with tech teams

Job description

The opportunity

A leading UK financial services organisation is looking for a hands-on security professional to join its Security Operations Centre as the 3rd line escalation point for security incidents. This is an exciting time to join: the business is growing, winning new clients and going through a significant period of change and integration.

The role

The SOC provides 24/7 monitoring, with alerts triaged by first and second line before they come to you. This role picks up the incidents that need real investigation and resolution. It isn't a pass-the-ticket role: you'll diagnose and fix issues yourself, then take remediation plans to other technology teams and walk them through the fix.

• Lead response to escalated security incidents within agreed SLAs, with the depth of action driven by how critical the incident is
• Investigate the data in front of you, work out the underlying problem and avoid false positives
• Work with external security partners to make sure monitoring, rulesets and triage are accurate and effective
• Act as a technical subject matter expert in the Cyber Incident Response team
• Analyse trends in security reporting and work with teams to improve security behaviours
• Maintain and improve the security tooling stack and run phishing campaigns
• Build strong relationships with stakeholders across Technology Services

About you

Essential

• Proven SOC experience as an analyst or engineer
• Broad technical understanding
• Experience with SIEM, IAM and DLP technologies, ideally in an Azure/Microsoft 365 environment
• Experience analysing attacks using frameworks such as MITRE ATT&CK
• Confidence in communicating with technical teams across the business

Nice to have

• Scripting or programming knowledge
• Financial services experience
• Relevant security certifications

Open to different backgrounds:

If you've spent time in in-house operational security, or moved from 1-2 years in a technical support or helpdesk role into operational security, we'd like to hear from you. Cloud engineering experience can also make up for fewer years in a SOC.

Security Operations Specialist

£65,0000 + generous package

Liverpool / hybrid