Senior SOC Analyst - Detection Engineering (SC Cleared)

Sanderson Government & Defence; City Of London; On-site; GBP 72,000 - 94,000; Full time

Job summary

Sanderson Government & Defence seeks a Senior SOC Analyst - Detection Engineering (SC Cleared) for a nine-month contract in London. You will develop detections and tune security monitoring across AWS and Splunk, working within a SOC to protect critical public sector services.

You will build high‑fidelity detections, reduce false positives, and support incident response while collaborating with SOC analysts, engineers, and stakeholders.

Qualifications

• Active SC Clearance (required).
• 1–3 years' experience in a SOC/Detection role.
• Hands-on Splunk SPL query development experience.
• Experience building, tuning and maintaining SIEM detection rules.
• AWS security monitoring experience: CloudTrail, GuardDuty, IAM, and VPC Flow Logs.

Responsibilities

• Develop, test and optimise Splunk detections and alerting logic.
• Create detection use cases aligned to attacker techniques (TTPs).
• Build AWS-focused detections leveraging CloudTrail, GuardDuty, IAM and VPC Flow Logs.
• Tune detection content to reduce false positives and improve alert accuracy.
• Map detection coverage to the MITRE ATT&CK framework.
• Monitor and triage security alerts within Splunk SIEM; investigate security incidents.

Skills

Splunk SPL queries

SPL query development

AWS security monitoring

Threat detection methods

Incident triage

Communication with stakeholders

Tools

Splunk

Sigma

YARA

CloudTrail

GuardDuty

Job description

Senior SOC Analyst - Detection Engineering (SC Cleared) £450 per day | Outside IR35 | 9-Month ContractActive SC Clearance Required | London (1 day per month onsite)

A leading consultancy is looking for a Senior SOC Analyst to join a high-profile cyber security programme supporting critical public sector services. This role offers a unique blend of detection engineering and SOC operations, providing the opportunity to develop and optimise advanced detection capabilities while helping protect large-scale cloud environments.

Working within a Security Operations Centre (SOC), you'll be responsible for building and tuning detections, investigating security incidents, and improving the effectiveness of security monitoring across AWS and Splunk environments.

The Role

As a Senior SOC Analyst, you will operate at the intersection of security operations, threat detection, and cloud security. You'll work closely with SOC analysts, engineers, and stakeholders to develop high-fidelity detections, reduce false positives, and strengthen overall security visibility.

This is an excellent opportunity for someone with Splunk and AWS security monitoring experience who enjoys both hands-on threat analysis and detection development.

Key Responsibilities

Detection Engineering

• Develop, test, and optimise Splunk SPL correlation searches and alerting logic.
• Create and maintain detection use cases aligned to attacker tactics, techniques, and procedures (TTPs).
• Build AWS-focused detections leveraging CloudTrail, GuardDuty, IAM activity, and VPC Flow Logs.
• Tune and enhance detection content to improve alert accuracy and reduce false positives.
• Develop signatures and detections using Sigma, YARA, and IDS-based rules where appropriate.
• Map detection coverage against the MITRE ATT&CK framework.

SOC Operations

• Monitor and triage security alerts within Splunk SIEM.
• Investigate security incidents including phishing attacks, credential abuse, malicious process activity, and suspicious network traffic.
• Support incident response activities through containment and escalation procedures.
• Maintain detailed security case documentation and investigation notes.
• Contribute towards operational metrics including MTTD and MTTR targets.

Essential Skills & Experience

• Active SC Clearance (required).
• 1-3 years' experience within a SOC Analyst, Security Analyst, Detection Engineer, or Security Operations role.
• Strong hands-on experience with Splunk and SPL query development.
• Experience building, tuning, and maintaining SIEM detection rules.
• AWS security monitoring experience including:
  • CloudTrail
  • GuardDuty
  • IAM
  • VPC Flow Logs
• Understanding of cyber attack techniques and threat detection methodologies.
• Knowledge of incident triage, investigation, and escalation processes.
• Experience working with Windows, Linux, authentication systems, and endpoint security logs.
• Strong communication and stakeholder engagement skills.

Desirable Skills

• Experience with Cribl.
• Knowledge of OCSF schemas and security data normalisation.
• Familiarity with MITRE ATT&CK and NICE Cybersecurity Frameworks.
• Experience with Sigma, YARA, or IDS signature development.
• Exposure to Splunk SOAR, Cortex XSOAR, or other automation platforms.
• Scripting experience in Python, PowerShell, or Bash.
• Experience working within UK Government or public sector environments.
• Azure and/or Google Cloud Platform exposure.

Reasonable Adjustments

Respect and equality are core values to us. We are proud of the diverse and inclusive community we have built, and we welcome applications from people of all backgrounds and perspectives. Our success is driven by our people, united by the spirit of partnership to deliver the best resourcing solutions for our clients.