Senior SOC Lead & Incident Response Architect

Oscar; England; On-site; GBP 85,000 - 110,000; Full time

Job summary

Oscar is seeking a Senior SOC Analyst (Level 3) / Technical Lead in Buckinghamshire. The role focuses on owning high‑severity incidents from ransomware to data breaches, with real-time containment decisions and senior client communication.

You'll conduct proactive threat hunts, develop detection content for SIEM/EDR and cloud platforms, and mentor junior analysts. On-site work pattern includes 3 days at the client location with on‑call for emergencies.

Qualifications

• 5+ years in incident response or SOC environments.
• Proven record leading complex investigations (ransomware/breach).
• Advanced malware analysis capability including behavioral analysis and reverse engineering.
• Deep expertise across enterprise SIEM platforms and EDR tooling (CrowdStrike knowledge is a strong advantage).
• Threat hunting toolkit: YARA, IOC development, timeline analysis.

Responsibilities

• Lead the most serious investigations in the client portfolio - ransomware, supply-chain compromise, data breaches, insider cases - owning the full lifecycle from detection through recovery.
• Make real-time containment calls under pressure and brief client leadership, up to board level, in language they can act on.
• Run proactive threat hunts and build detection content across SIEM, EDR and cloud platforms, tuning out noise as you go.
• Develop SOAR playbooks and automation, and help shape the SOC's tooling roadmap and architecture.
• Produce evidential-standard reporting fit for auditors, regulators and law enforcement.
• Mentor the analyst team and act as senior escalation point for major incidents.

Skills

Incident response

SOC leadership

Malware analysis

Threat hunting

Executive communication

Mentoring

Intrusion detection

Cloud incident response

YARA rules

IOC development

Tools

CrowdStrike

YARA

Azure

AWS

SIEM

EDR tooling

Job description

Oscar is seeking a Senior SOC Analyst (Level 3) / Technical Lead in Buckinghamshire. The role focuses on owning high‑severity incidents from ransomware to data breaches, with real-time containment decisions and senior client communication.

You'll conduct proactive threat hunts, develop detection content for SIEM/EDR and cloud platforms, and mentor junior analysts. On-site work pattern includes 3 days at the client location with on‑call for emergencies.