Senior SOC Analyst — Incident Response Lead

GHD; North East; On-site; GBP 70,000 - 110,000; Full time

Job summary

GHD is seeking a Senior SOC Analyst - Incident Response to lead complex, high-severity investigations across a large enterprise. You will own investigations end-to-end, shape critical response decisions and strengthen detection, containment and lessons across the organisation.

Reporting to the SOC Manager, you will mentor junior analysts, develop playbooks and work with infrastructure, identity, cloud and IT teams to coordinate rapid containment and recovery in a fast-moving environment.

Qualifications

• At least five years’ experience in security operations and incident response in a large, global organisation.
• Experience leading major security investigations and coordinating stakeholders through full response lifecycle.
• Deep, hands-on expertise in Microsoft Sentinel, including incidents, investigations and analytics.
• Strong knowledge of Microsoft Defender XDR, identity-based attacks and hybrid cloud environments.
• Ability to form, test and refine investigative hypotheses using evidence from multiple sources.
• Calm, decisive judgement under pressure, with the confidence to act when information is incomplete.
• Collaborative, curious and disciplined approach to incident handling and continuous improvement.
• Bonus: certifications such as SC-200, AZ-500, GCED, GCIA, GCIH, CISSP or CISM.

Responsibilities

• Lead and coordinate high-severity security incident investigations end-to-end.
• Establish incident scope, impact and likely root cause using Sentinel and Defender XDR.
• Direct response actions in partnership with infrastructure, identity, cloud and IT teams.
• Maintain investigation records and produce accurate post-incident reports.
• Develop, tune and maintain Sentinel analytics rules to improve signal quality.
• Conduct hypothesis-driven threat hunting using Sentinel and Defender Advanced Hunting.
• Convert findings into practical detection and response improvements.
• Mentor junior analysts and help define playbooks and escalation thresholds.
• Collaborate with the managed security service provider for triage and escalation.
• Brief technical and non-technical stakeholders during active incidents.

Skills

Security operations

Incident response

Stakeholder coordination

Mentoring

Calm under pressure

Technical communication

Tools

Microsoft Sentinel

Defender XDR

Entra ID

Microsoft 365

Azure

Job description

GHD is seeking a Senior SOC Analyst - Incident Response to lead complex, high-severity investigations across a large enterprise. You will own investigations end-to-end, shape critical response decisions and strengthen detection, containment and lessons across the organisation.

Reporting to the SOC Manager, you will mentor junior analysts, develop playbooks and work with infrastructure, identity, cloud and IT teams to coordinate rapid containment and recovery in a fast-moving environment.