Senior SOC Incident Lead & Detection Engineer

Xact Placements Limited; Reading; Hybrid; GBP 50,000 - 60,000; Full time

Benefits offered by this job

Hybrid work arrangement

Competitive salary

Job summary

Xact Placements Limited is recruiting a 2nd/3rd Line Security Analyst in Reading. This hybrid role centers on hands-on incident response, detection engineering and automation within the SOC.

You will own end-to-end incidents and provide senior technical depth across multiple toolchains. Key duties include designing SIEM detections aligned to MITRE ATT&CK, mentoring analysts, and driving improvements in detections and playbooks while working with Sentinel, Defender XDR, CrowdStrike, Entra

Qualifications

• Proven ownership of complex security incidents from triage through closure.
• Hands-on experience writing and tuning SIEM detection logic and understanding MITRE ATT&CK.
• Practical scripting/automation experience (Python, REST APIs) or hands-on SOAR configuration.

Responsibilities

• Own complex security incidents end-to-end from alert validation through containment and closure.
• Act as senior escalation point when investigations stall, reviewing prior work and coaching analysts.
• Investigate identity and cloud-based compromise including anomalous sign-ins and OAuth issues.
• Design, build and test SIEM detection rules mapped to MITRE ATT&CK and tune false positives.
• Build automation for SOC processes using Python, Logic Apps, APIs or SOAR.
• Correlate evidence across SIEM, endpoint, identity and cloud platforms to scope blast radius.
• Run hypothesis-led threat hunts and mentor junior analysts to improve detections.

Skills

SIEM tuning

MITRE ATT&CK

KQL

Threat hunting

Python scripting

SOAR platforms

Incident response

Tools

Microsoft Sentinel

Defender XDR

CrowdStrike

Entra ID/Azure AD

Microsoft 365

AWS security tooling

Job description

Xact Placements Limited is recruiting a 2nd/3rd Line Security Analyst in Reading. This hybrid role centers on hands-on incident response, detection engineering and automation within the SOC.

You will own end-to-end incidents and provide senior technical depth across multiple toolchains. Key duties include designing SIEM detections aligned to MITRE ATT&CK, mentoring analysts, and driving improvements in detections and playbooks while working with Sentinel, Defender XDR, CrowdStrike, Entra