Senior SOC Detection Engineer (SC Cleared)

Sanderson Government & Defence; City Of London; On-site; GBP 72,000 - 94,000; Full time

Job summary

Sanderson Government & Defence seeks a Senior SOC Analyst - Detection Engineering (SC Cleared) for a nine-month contract in London. You will develop detections and tune security monitoring across AWS and Splunk, working within a SOC to protect critical public sector services.

You will build high‑fidelity detections, reduce false positives, and support incident response while collaborating with SOC analysts, engineers, and stakeholders.

Qualifications

• Active SC Clearance (required).
• 1–3 years' experience in a SOC/Detection role.
• Hands-on Splunk SPL query development experience.
• Experience building, tuning and maintaining SIEM detection rules.
• AWS security monitoring experience: CloudTrail, GuardDuty, IAM, and VPC Flow Logs.

Responsibilities

• Develop, test and optimise Splunk detections and alerting logic.
• Create detection use cases aligned to attacker techniques (TTPs).
• Build AWS-focused detections leveraging CloudTrail, GuardDuty, IAM and VPC Flow Logs.
• Tune detection content to reduce false positives and improve alert accuracy.
• Map detection coverage to the MITRE ATT&CK framework.
• Monitor and triage security alerts within Splunk SIEM; investigate security incidents.

Skills

Splunk SPL queries

SPL query development

AWS security monitoring

Threat detection methods

Incident triage

Communication with stakeholders

Tools

Splunk

Sigma

YARA

CloudTrail

GuardDuty

Job description

Sanderson Government & Defence seeks a Senior SOC Analyst - Detection Engineering (SC Cleared) for a nine-month contract in London. You will develop detections and tune security monitoring across AWS and Splunk, working within a SOC to protect critical public sector services.

You will build high‑fidelity detections, reduce false positives, and support incident response while collaborating with SOC analysts, engineers, and stakeholders.