Senior SOC Engineer

Sopra Steria Limited; Farnborough; On-site; GBP 65,000 - 90,000; Full time

Benefits offered by this job

Professional development

Mentoring and knowledge sharing

Job summary

Sopra Steria Limited is seeking a SOC Detection Engineer in the UK to turn threat intelligence into robust detection logic across MS Sentinel and Splunk. You will implement detection rules, optimize alerts, and collaborate with SOC, Threat Intelligence and Security Architecture teams to improve security operations.

The role involves onboarding log sources, cloud and infrastructure monitoring, and continual improvement through automation and scripting.

Qualifications

• Experience in SOC engineering, detection engineering or SIEM engineering.
• Strong hands-on experience with Microsoft Sentinel and Splunk.
• Solid knowledge of KQL and SPL.
• Experience building, testing and maintaining detection rules.
• Good understanding of SIEM lifecycle management and security telemetry.
• Knowledge of cloud environments and IT infrastructure.
• Familiarity with MITRE ATT&CK.

Responsibilities

• Develop, test and deploy detection content across Microsoft Sentinel and Splunk.
• Write and optimise detection logic using KQL and SPL.
• Turn monitoring requirements into effective, actionable detections.
• Tune alerts to reduce false positives and improve SOC efficiency.
• Validate detections against telemetry and ensure accuracy.
• Support onboarding of log sources across cloud, infrastructure, identity and network.
• Collaborate with SOC, Threat Intelligence and Security Architecture teams.
• Investigate detection issues and improve performance and reliability.
• Drive continuous improvement using automation, scripting and best practice.
• Ensure detections are clearly documented and operationally usable.

Skills

Microsoft Sentinel

Splunk

KQL

SPL

Threat analysis

CI/CD pipelines

PowerShell

Python

Git-based workflows

SOAR

Tools

Logic Apps

Splunk SOAR

Git

PowerShell

Python

Job description

Responsibilities

• Develop, test and deploy detection content across Microsoft Sentinel and Splunk SIEM.
• Write and optimise detection logic using KQL and SPL.
• Turn monitoring requirements and use cases into effective, actionable detections.
• Tune alerts to reduce false positives and improve SOC efficiency.
• Validate detections against telemetry and ensure accuracy.
• Support onboarding of log sources across cloud, infrastructure, identity and network.
• Collaborate with SOC, Threat Intelligence and Security Architecture teams.
• Investigate detection issues and improve performance and reliability.
• Drive continuous improvement using automation, scripting and best practice.
• Ensure detections are clearly documented and operationally usable.

Experience

• Experience in SOC engineering, detection engineering or SIEM engineering.
• Strong hands-on experience with Microsoft Sentinel and Splunk.
• Solid knowledge of KQL and SPL.
• Experience building, testing and maintaining detection rules.
• Good understanding of SIEM lifecycle management and security telemetry.
• Knowledge of cloud environments and IT infrastructure.
• Familiarity with frameworks such as MITRE ATT&CK.
• Ability to analyse threats and translate them into detection capability.

Nice to have:

• Experience with SOAR (Logic Apps / Splunk SOAR).
• Detection-as-code or CI/CD pipeline experience.
• Scripting in PowerShell, Python or similar.
• Experience with Git-based workflows.
• Relevant certifications (Microsoft, Splunk, Cyber Security).

Role Overview

If you thrive on turning threat intelligence into actionable detection logic-and enjoy working at the heart of a live SOC-this is your opportunity to make a real impact., Sopra Steria's Aerospace, Defence and Security business designs, develops and deploys digital solutions to Central Government clients. The work we do makes a real difference to the client's goal of National Security, and we operate in a unique and privileged environment.

Benefits

• We are given time for professional development activities, and we coach and mentor our colleagues, sharing knowledge and learning from each other. We foster a culture in which employees feel valued and supported and have pride in their work for the customer, delivering outstanding rates of customer satisfaction in the UK's most complex safety- and security-critical markets.