Senior SOC Analyst

MCS Group; Belfast City District; On-site; GBP 65,000 - 100,000; Full time

Job summary

MCS Group is seeking a Senior Security Analyst to join its global Security Operations Centre. You will monitor, investigate and respond to security alerts across SIEM, EDR and cloud environments, helping to detect threats and coordinate containment.

You will develop detection rules, conduct threat hunting, and produce incident reports while collaborating with IT teams. Experience in MITRE ATT&CK, log analysis and scripting is valued to improve detection capabilities and incident response

Qualifications

• Experience in a Security Operations Centre (SOC) or dedicated monitoring and incident response function.
• Hands-on use of SIEMs to investigate alerts, correlate events and identify threats.
• Proven incident response experience across containment, eradication and recovery.

Responsibilities

• Monitor, analyse and investigate security alerts from SIEMs and EDR solutions.
• Lead or support incident response activities including containment and post-incident analysis.
• Investigate suspicious activity across endpoints, networks, identities, and cloud environments.

Skills

SOC experience

SIEM proficiency

Incident response

EDR/XDR

Threat hunting

MITRE ATT&CK

Threat intelligence

Log analysis

Python/PowerShell

Education

Bachelor's degree in Cybersecurity/CS

Tools

KQL

Windows Security

Linux Security

Cloud security monitoring

Azure/AWS

PowerShell

Python

Job description

About the Role

As a Senior Security Analyst, you'll play a key role in protecting the organisation against cyber threats through proactive security monitoring, threat detection, investigation and incident response. Working within a collaborative global Security Operations Centre (SOC), you'll be responsible for identifying suspicious activity, analysing security alerts and responding effectively to potential security incidents.

This role offers the opportunity to work across a broad range of security technologies, with a particular focus on SIEM platforms, incident investigation, threat detection and response. You'll contribute to improving detection capabilities, strengthening incident response processes and enhancing the organisation's overall security posture.

Key Responsibilities

• Monitor, analyse and investigate security alerts generated through SIEM platforms, EDR solutions and other security monitoring technologies.
• Perform detailed triage of security events, distinguishing genuine threats from false positives and determining appropriate escalation or remediation actions.
• Lead or support incident response activities, including investigation, containment, eradication, recovery and post-incident analysis.
• Investigate suspicious activity across endpoints, networks, identities, applications and cloud environments to identify potential security compromises.
• Utilise SIEM technologies such as Microsoft Sentinel, Splunk or QRadar to correlate security events, investigate threats and identify indicators of compromise.
• Analyse security logs, authentication events, endpoint telemetry and network activity to identify malicious behaviour and emerging threats.
• Conduct threat hunting activities using threat intelligence, indicators of compromise (IOCs) and attacker techniques to identify potential security risks.
• Work closely with Security Engineering, Infrastructure and wider IT teams to coordinate effective incident response and remediation activities.
• Develop, refine and optimise SIEM detection rules, alerting logic and security monitoring use cases to improve detection capabilities and reduce false positives.
• Contribute to the development and continuous improvement of SOC processes, incident response playbooks and operational procedures.
• Produce clear incident reports, documenting investigation findings, actions taken, root causes and recommendations for future prevention.
• Support the implementation and improvement of security monitoring tools, processes and technologies across the organisation.

Technical Skills

Experience across several of the following areas would be advantageous:

Security Operations & Monitoring

• Security Operations Centre (SOC)
• Security Information and Event Management (SIEM)
• Microsoft Sentinel, Splunk, QRadar or similar SIEM platforms
• Security Event Monitoring & Alert Triage
• Log Analysis & Event Correlation
• Security Detection Engineering
• Security Orchestration, Automation & Response (SOAR)

Incident Response & Threat Detection

• Security Incident Investigation & Response
• Incident Containment, Eradication & Recovery
• Endpoint Detection & Response (EDR)
• Microsoft Defender XDR
• CrowdStrike Falcon
• Threat Hunting & Threat Intelligence
• Indicators of Compromise (IOCs)
• MITRE ATT&CK Framework
• Malware Analysis & Investigation
• Phishing Investigation & Response
• Vulnerability Management

Additional Technical Knowledge

• Kusto Query Language (KQL)
• Windows & Linux Security
• Network Security Fundamentals
• Identity & Access Management (IAM)
• Microsoft Entra ID (Azure AD)
• Microsoft 365 Security
• Azure & AWS Security Monitoring
• Cloud Security Fundamentals
• PowerShell or Python Scripting

What You'll Bring

• Strong experience working within a Security Operations Centre (SOC) or dedicated security monitoring and incident response function.
• Hands-on experience using SIEM technologies to investigate security alerts, correlate events and identify potential threats.
• Proven experience investigating and responding to security incidents, with an understanding of the full incident response lifecycle.
• Experience working with EDR/XDR technologies to investigate suspicious endpoint activity and potential compromises.
• Strong understanding of common cyber threats, attack techniques and indicators of compromise.
• Ability to analyse security logs and telemetry from multiple sources to identify malicious or unusual activity.
• Strong analytical and investigative skills, with the ability to prioritise incidents based on severity, impact and business risk.
• Experience contributing to improvements in detection rules, SOC processes and incident response procedures.
• Excellent communication skills, with the ability to document investigations and communicate technical findings clearly.
• A proactive, collaborative approach to security operations, with a focus on continuous improvement.