Senior SOC Analyst

Resillion; Birmingham; Hybrid; GBP 65,000 - 90,000; Full time

Benefits offered by this job

Hybrid work model

Career development support

Certification assistance

Job summary

Resillion is seeking a Senior SOC Analyst in Birmingham for a hybrid/remote role. You will lead complex security incidents, mentor SOC analysts, and perform proactive threat hunting across diverse customer environments.

The ideal candidate has 4+ years of security operations experience with SIEMs (prefer Microsoft Sentinel), strong threat hunting skills, and practical knowledge of MITRE ATT&CK. Rotation shifts apply, and SC clearance eligibility is required.

Qualifications

• Extensive security monitoring and incident investigation with SIEM
• Experience tuning detection rules, analytics, dashboards and alerts
• Advanced knowledge of threat detection methodologies and MITRE ATT&CK
• Strong networking knowledge (TCP/IP, DNS, HTTP/S, VPNs) and security protocols
• Hands-on with Windows, Linux, AD, Azure and cloud security tools
• Experience leading incidents through full lifecycle and mentoring juniors
• Experience in MSSP/SOC environments with stakeholder management
• Ability to produce detailed technical and executive incident reports

Responsibilities

• Lead investigation and analysis of complex security incidents and determine root cause
• Act as senior escalation point for SOC Analysts and provide technical leadership
• Conduct advanced threat hunting across customer environments
• Analyse threat intelligence to improve detection and response
• Lead evaluation of customer security postures and recommend improvements
• Drive improvements to incident response, detection engineering, and SOC processes
• Own creation and optimization of SOC playbooks, runbooks, and procedures
• Develop and maintain SIEM use cases, correlation rules, dashboards, and alerts
• Oversee vulnerability management and remediation guidance
• Collaborate with Incident Response and Engineering teams during incidents
• Produce executive-level incident reports and service-review documentation
• Support customer onboarding including log source integration and strategy

Skills

SIEM experience

Threat hunting

MITRE ATT&CK

Incident response

Mentoring juniors

Networking basics

Cloud security

Analytical thinking

Rotational shifts

SOC leadership

Windows/Linux/AD/Azure

Tools

CrowdStrike Falcon

Microsoft Defender XDR

KQL

PowerShell scripting

Python scripting

Job description

Description

Role:

Senior SOC Analyst

Location:

Birmingham (Hybrid/Remote)

Experience:

4 years Plus

Shift Pattern:

Rotational Shifts

Due to the nature of the role, all applicants must hold a minimum of 5 years UK address history to be eligible for full Security Clearance (SC)

About Resillion

Resillion is a global provider of digital assurance, cybersecurity, and testing services. We help organisations strengthen their security posture, protect critical assets, and deliver high-quality digital solutions. Our teams operate across multiple specialist disciplines, including Digital Forensics, Incident Response, SOC Operations, Quality & Compliance, and Technical Consultancy. We are committed to excellence, continuous improvement, and delivering trusted, customer-focused services that meet the highest professional and accreditation standards.

Key Responsibilities

• Lead the investigation and analysis of complex security incidents, determining root cause, impact, and remediation activities.
• Act as a senior escalation point for SOC Analysts, providing mentoring, guidance, and technical leadership during incident investigations.
• Conduct advanced threat hunting activities across customer environments to proactively identify malicious activity and emerging threats.
• Analyse and contextualise Threat Intelligence from multiple sources to enhance detection capabilities and improve response effectiveness.
• Lead the evaluation of customer security postures and recommend improvements to strengthen defensive capabilities.
• Drive continuous improvement initiatives across incident response, detection engineering, and SOC operational processes.
• Own the creation, review, and optimisation of SOC Playbooks, Runbooks, and operational procedures.
• Develop, tune, and maintain SIEM use cases, correlation rules, alert logic, dashboards, and reporting capabilities.
• Provide technical leadership for vulnerability management activities, ensuring effective prioritisation and remediation guidance.
• Collaborate with Incident Response, Engineering, Threat Intelligence, and customer teams during security incidents and service improvements.
• Produce detailed technical and executive-level incident reports, recommendations, and service review documentation.
• Support customer onboarding activities, including log source integration, detection design, and security monitoring strategy.

Required Skills and Qualifications

• Extensive security monitoring and incident investigation experience with one or more SIEM platforms, preferably Microsoft Sentinel.
• Strong experience developing, tuning, and optimising SIEM detection rules, analytics, dashboards, and alerting frameworks.
• Advanced knowledge of threat detection methodologies, attack frameworks such as MITRE ATT&CK, and threat hunting techniques.
• Strong understanding of networking principles including TCP/IP, WANs, LANs, DNS, HTTP/S, VPNs, and commonly used Internet protocols.
• Strong hands-on experience across Windows, Linux, Active Directory, Microsoft Azure, and cloud security technologies.
• Deep understanding of security technologies including SIEM, EDR/XDR, Firewalls, IDS/IPS, Web Proxies, Email Security, Identity and Access Management, and Encryption technologies.
• Proven experience managing and responding to security incidents throughout the full incident lifecycle.
• Experience conducting malware analysis, vulnerability management, and forensic triage activities.
• Previous MSSP/SOC experience with excellent stakeholder management and communication skills.
• Ability to mentor and support junior analysts while maintaining high operational standards.
• Strong analytical, troubleshooting, and problem-solving skills with excellent attention to detail.
• Comfortable working within a rotational shift environment

Desirable Skills and Qualifications

• Microsoft certifications such as AZ-500, SC-200, SC-300, or equivalent security-focused certifications.
• Strong knowledge of Microsoft Kusto Query Language (KQL) and detection engineering practices.
• Hands-on experience with CrowdStrike Falcon and Microsoft Defender XDR.
• Experience leading or supporting Cyber Incident Response engagements aligned to NIST frameworks.
• Knowledge of threat intelligence platforms and threat hunting methodologies.
• Industry certifications such as CISSP, GCIA, GCIH, GCFA, CySA+, or Security+.
• Familiarity with ITIL practices regarding Incident, Problem, and Change Management.
• Experience automating security operations through scripting (PowerShell, Python, or similar).

Why Join Resillion?

• Opportunity to work within a growing and highly skilled Security Operations team.
• Exposure to a wide range of customer environments and security technologies.
• Career development and certification support.
• Collaborative and supportive working environment.
• Flexible hybrid working options.
• Opportunity to help organisations protect themselves against evolving cyber threats.