Senior SOC Analyst

Focus Group; Manchester; Hybrid; GBP 60,000 - 90,000; Full time

Job summary

Focus Group is seeking a Senior SOC Analyst to lead our Managed Security Services team in the UK. This dual‑focus role combines hands‑on security work with day‑to‑day operational leadership to deliver high‑quality managed detection and response for a diverse client base.

You will guide day‑to‑day SOC operations, mentor junior analysts, coordinate incident response, and work with security leadership to improve detection coverage, tooling, and playbooks while staying current with evolving threats.

Qualifications

• 4–6 years' experience in a SOC or MSSP at Tier 2‑3 or Lead level.
• Hands‑on with SIEM platforms (e.g., Microsoft Sentinel, Splunk, Elastic, LogPoint).
• Experience with EDR tools such as Microsoft Defender, SentinelOne, or Bitdefender.
• Knowledge of MITRE ATT&CK and threat detection methodologies.
• Strong incident response, investigation, and log analysis across multiple data sources.
• Ability to lead during high‑pressure incidents with calm, confident decision‑making.
• Strong communication skills, including producing clear incident reports and updates.
• Proven ability to mentor, coach, and support junior analysts.
• Organised approach with the ability to manage multiple concurrent incidents.
• Proactive mindset focused on continuous improvement and service optimisation.

Responsibilities

• Lead day‑to‑day SOC operations with triage, escalation, and comms workflows.
• Act as primary escalation point for complex investigations.
• Conduct advanced threat investigations across endpoints, networks, and cloud environments.
• Perform proactive threat hunting and detection tuning to improve coverage and reduce noise.
• Manage and mentor Tier 1-2 analysts, supporting development and technical growth.
• Ensure ticket quality, SLA adherence, and high service standards across SOC operations.
• Onboard new customers into monitoring and detection platforms.
• Collaborate with Cyber Security leadership to improve detection strategy and SOC maturity.
• Analyse logs and security data to identify malicious or suspicious activity.
• Develop and maintain playbooks, runbooks, and knowledge base content.
• Produce clear, actionable incident reports for internal and customer stakeholders.
• Engage directly with customers during escalations, incident reviews, and briefings.
• Identify opportunities for automation, process improvement, and enhanced detection capabilities.
• Stay up to date with emerging threats, attack techniques, and MITRE ATT&CK developments.

Skills

SOC/MSSP experience

SIEM (Sentinel, Splunk)

EDR tools

MITRE ATT&CK

Incident response

Leadership

Communication

Mentoring

Log analysis

Automation mindset

Education

Tools

Microsoft Defender

SentinelOne

Bitdefender

KQL

PowerShell

Python

SOAR

Job description

(Internal Job Level Reference: Specialist)

UK • Hybrid - 3 days a week in our Manchester office (Suite B, Maple Court, M60 Office Park, Wynne Ave, Swinton, Clifton, Manchester, M27 8FF)

Focus Group is looking for a Senior SOC Analyst to play a key role within our Managed Security Services team. This is a dual‑focused position combining hands‑on technical expertise with day‑to‑day operational leadership, ensuring high‑quality delivery of managed detection and response services across a diverse customer base.

You'll lead SOC operations, act as the escalation point for complex security incidents, and mentor junior analysts—driving both service excellence and team development.

Senior SOC Analyst

(Internal Job Level Reference: Specialist)

Focus Group is looking for a Senior SOC Analyst to play a key role within our Managed Security Services team. This is a dual‑focused position combining hands‑on technical expertise with day‑to‑day operational leadership, ensuring high‑quality delivery of managed detection and response services across a diverse customer base.

You'll lead SOC operations, act as the escalation point for complex security incidents, and mentor junior analysts—driving both service excellence and team development.

What you'll do

• Lead day‑to‑day SOC operations, ensuring effective triage, escalation, and communication workflows
• Act as the primary escalation point for complex security investigations and incidents
• Conduct advanced threat investigations across endpoints, networks, and cloud environments
• Perform proactive threat hunting and detection tuning to improve coverage and reduce noise
• Manage and mentor Tier 1-2 analysts, supporting development and technical growth
• Ensure ticket quality, SLA adherence, and high service standards across SOC operations
• Support onboarding of new customers into monitoring and detection platforms
• Collaborate with Cyber Security leadership to improve detection strategy and SOC maturity
• Analyse logs and security data to identify malicious or suspicious activity
• Develop and maintain playbooks, runbooks, and knowledge base content
• Produce clear, actionable incident reports for internal and customer stakeholders
• Engage directly with customers during escalations, incident reviews, and briefings
• Identify opportunities for automation, process improvement, and enhanced detection capabilities
• Stay up to date with emerging threats, attack techniques, and MITRE ATT&CK developments

What you'll bring

• 4-6 years' experience in a SOC or MSSP environment at Tier 2-3 or Lead level
• Strong hands‑on experience with SIEM platforms (e.g. Microsoft Sentinel, Splunk, Elastic, LogPoint)
• Experience with EDR tools such as Microsoft Defender, SentinelOne, or Bitdefender
• Deep understanding of MITRE ATT&CK and modern threat detection methodologies
• Strong incident response, investigation, and log analysis capability across multiple data sources
• Ability to lead during high‑pressure incidents with calm, confident decision‑making
• Strong communication skills, including producing clear incident reports and updates
• Proven ability to mentor, coach, and support junior analysts
• Organised approach with the ability to manage multiple concurrent incidents
• Proactive mindset focused on continuous improvement and service optimisation

Nice to have

• Certifications such as SC‑200, GCIH, GCIA, Security+, or BTL1
• Experience in an MSSP or multi‑customer environment
• Microsoft security stack experience (Defender XDR, Sentinel, M365 security)
• Knowledge of cloud security, email security, and vulnerability management
• Experience with KQL or other query languages
• Scripting skills (PowerShell, Python)
• Familiarity with SOAR and threat intelligence platforms
• Understanding of compliance frameworks (ISO 27001, NIST, Cyber Essentials)

Future opportunities

• SOC Manager / Head of Security Operations
• Cyber Security Technical Lead
• Detection Engineering Lead
• Threat Intelligence Lead
• Incident Response Manager
• Security Consultant / Advisory

IND1