Senior SOC Analyst

LT Harper Group; Greater London; On-site; GBP 101,000 - 175,000; Full time

Benefits offered by this job

Three days off after every four-day on

16:00 finish after shifts

Input into AI tooling use

Job summary

LT Harper Group in London is seeking a Senior SOC Analyst for its UK hub. This hands-on role focuses on incident response, threat hunting, and leading investigations from first alert to root cause, with macOS expertise strongly preferred.

The contract runs initially until March 2027, with four 10-hour shifts (06:00-16:00) onsite in City of London and a chance to shape AI-driven tooling within a global SOC.

Qualifications

• Senior hands-on experience in operational SOC or incident response.
• IR experience in macOS, Linux/cloud, or containers.
• Strong networking knowledge; background in infrastructure engineering is a plus.
• Scripting to automate investigations and responses.
• Experience using AI tooling to streamline automation.
• Able to work onsite in London.

Responsibilities

• Manage your caseload with triage, investigation and response.
• Conduct deep investigations and root-cause analysis across macOS, Linux and cloud workloads; guide eviction and recovery.
• Develop and tune alerts to detect anomalous/malicious activity.
• Build scripts and AI-assisted automation to speed triage and response.
• Contribute to threat hunting, detection engineering and improvement programs.
• Coordinate with Hunt, Threat Intelligence, Digital Forensics, Legal and Infra teams during incidents.

Skills

Senior hands-on IR/SOC

macOS IR

Scripting for automation

AI tooling

On-site London shifts

Tools

Splunk

Job description

Senior SOC Analyst, Incident Response and Threat Hunting (Contract)

You'll be one of two senior analysts joining the UK hub of a global SOC, owning live caseload and leading investigations from first alert to root cause. This is a hands-on operational role for someone who enjoys the investigation itself, and macOS incident response experience will put you at the front of the queue.

• Location: City of London, onsite for every shift
• Shifts: four 10-hour shifts, 06:00 to 16:00, either Sunday to Wednesday or Wednesday to Saturday
• Contract: ASAP start, initially until March 2027
• Level: Senior, leading investigations technically (no line management)

What you'll actually do

• Manage your own caseload, handling triage, investigation and response day to day
• Run deep investigations and root-cause analysis across macOS, Linux and cloud workloads, then guide the business through eviction and recovery
• Build scripts and AI-assisted automation workflows to speed up triage and response, working with Splunk and a newly introduced agentic AI SOC platform
• Develop and tune alerts to catch anomalous and malicious activity
• Contribute to threat hunting, detection engineering and the team's improvement programmes
• Work closely with the Hunt, Threat Intelligence, Digital Forensics, Legal and Infrastructure teams during incidents

What you'll need

• Senior, hands-on experience in operational SOC or incident response work, with a clear method for how you investigate
• Incident response experience in at least two of: macOS endpoints, Linux in cloud environments, microservices and containers
• Strong networking knowledge. Many of the best fits here started in network or infrastructure engineering before moving into IR
• Scripting to automate investigation and response tasks
• Practical experience using AI tooling to build automation workflows
• Able to work the shift pattern onsite in London

Nice to have

• Splunk
• Proactive threat hunting
• Agentic AI SOC tooling

What's in it for you

Three days off after every four-day block, a 16:00 finish, and real input into how AI-driven tooling is used inside a global SOC.