Senior SOC Incident Response Lead (Tier 3)

Booz Allen Hamilton; Cambridgeshire and Peterborough; On-site; GBP 70,000 - 110,000; Full time

Job summary

Booz Allen Hamilton seeks a Senior Tier 3 Incident Response Analyst to lead complex investigations, provide senior technical direction, and strengthen enterprise cyber defense. You will stay hands-on with DFIR while coordinating case management, evidence handling, and stakeholder communications.

Mentor junior analysts and help drive playbooks and detections improvements. The role emphasizes timely incident containment, eradication, recovery actions, and collaboration across SOC, infrastructure,

Qualifications

• Experience in cyber security operations, digital forensics, threat hunting, or a cyber defense field, including leading or supporting complex investigations.
• Experience with coordinating incident response across SOC, infrastructure, identity, legal, risk and business stakeholders.
• Ability to provide clear technical direction to Tier 1/2 analysts and lead Tier 3 investigations.
• Knowledge of incident response frameworks such as NIST IR and MITRE ATT&CK.

Responsibilities

• Lead investigations from escalation to resolution or handover under time pressure.
• Act as senior escalation point for Tier 1/2 analysts and determine containment, eradication, and recovery actions.
• Maintain oversight of case management, evidence tracking, incident reporting, and stakeholder coordination.
• Coach and mentor junior/mid-level analysts and potentially lead shift or major incidents.
• Support continuous improvement of SOC and IR operations through metrics and automation.

Skills

Cybersecurity operations

Digital forensics

Threat hunting

EDR/XDR

NDR

SIEM

Incident response leadership

Communication to stakeholders

DFIR expertise

Mentoring juniors

Education

Bachelor’s degree or 5+ years IT/cybersecurity/IR in lieu of degree

Tools

EDR/XDR

NDR

SIEM

Job description

Booz Allen Hamilton seeks a Senior Tier 3 Incident Response Analyst to lead complex investigations, provide senior technical direction, and strengthen enterprise cyber defense. You will stay hands-on with DFIR while coordinating case management, evidence handling, and stakeholder communications.

Mentor junior analysts and help drive playbooks and detections improvements. The role emphasizes timely incident containment, eradication, recovery actions, and collaboration across SOC, infrastructure,