SOC Analyst

CGI Group Inc.; Chippenham; On-site; GBP 55,000 - 75,000; Full time

Benefits offered by this job

Insurance coverage

Medical benefits

Pension plan

Member Assistant Programme

Check4Cancer

Flexible time off

Share Purchase Plan

Member discounts

Dental benefits

Vision benefits

Profit Participation Plan

Health and Well-being Programme

Job summary

CGI Group Inc. in the United Kingdom is seeking a Security Data & Detection Engineer to join the SOC onboarding team. You will work with customers to design how security data is ingested into Elastic, focused on Oracle Cloud with exposure to AWS, Azure and Google Cloud.

You will develop detection logic, triage guidance and monitor alerts, supporting incidents and continuous improvement in a hands-on environment with senior cyber professionals.

Qualifications

• Bachelor's degree or equivalent in a cyber security, computer science or software discipline.
• Experience with SIEM technologies such as Elastic or Splunk is essential.
• Understanding of cyber security monitoring, alerts, incident triage or investigation is required.
• Knowledge of IT environments, Linux or other enterprise platforms is preferred.

Responsibilities

• Engineer & Deliver: Design and support security data ingestion pipelines into Elastic for new onboarded customers.
• Develop & Detect: Draft detection rules for defined cyber security use cases and create clear SOC triage guides.
• Engage & Onboard: Liaise with customers to gather data required for SOC onboarding.
• Monitor & Triage: Review security alerts, assess severity and impact.
• Investigate & Escalate: Support incident investigations and containment actions.
• Analyse & Respond: Monitor environments, investigate alerts and respond to incidents within SLAs.
• Learn & Improve: Research threats and share knowledge to improve processes.
• Support & Assure: Assist with investigations, testing, and first-line technical support.
• Operate & Automate: Ensure scheduled jobs and automation run reliably.

Skills

SIEM experience

Cloud security

Oracle Cloud

Linux/Enterprise OS

Analytical thinking

Communication skills

Customer engagement

Clear escalation

Cloud exposure (AWS/Azure/GCP)

Education

Bachelor's degree in Computer Science / Cyber Security

Tools

Elastic

Splunk

Linux

Job description

In this role, you will join CGI's Data and Detection Engineering team, supporting the onboarding of new customers into the Security Operations Centre (SOC). You'll work directly with customers to understand their environments and requirements before helping design how security data is ingested into Elastic. With a primary focus on Oracle Cloud and opportunities to build exposure to AWS, Microsoft Azure and Google Cloud, you'll develop detection logic and triage guidance that enables the SOC to identify and respond to potential threats effectively. You'll also contribute to day-to-day security monitoring and incident investigation, taking responsibility for assessing alerts, understanding their potential impact and escalating where appropriate. Working alongside experienced cyber professionals, you'll have opportunities to develop new approaches, broaden your technical knowledge and build practical experience across cloud security, SIEM and threat detection.

• Engineer & Deliver: Design and support security data ingestion pipelines into Elastic for newly onboarded customers.
• Develop & Detect: Draft detection rules against defined cyber security use cases and create clear SOC triage guides.
• Engage & Onboard: Liaise directly with customers to gather the technical information required for successful SOC onboarding.
• Monitor & Triage: Review security alerts from SIEM, intrusion detection, log monitoring and other security systems, assessing severity and potential impact.
• Investigate & Escalate: Support security incident investigations and recommend appropriate containment, eradication or escalation actions.
• Analyse & Respond: Monitor client environments, investigate alerts and respond to real or suspected cyber security incidents within agreed timescales.
• Learn & Improve: Research emerging threats, technologies and security practices, sharing knowledge with colleagues and contributing to continuous improvement.
• Support & Assure: Assist with security investigations, exercises, testing, change activities and first-line technical support.
• Operate & Automate: Help ensure scheduled security jobs and automated processes operate correctly and reliably.

You'll have a technical foundation in cyber security, computing, software engineering, digital forensics or a related discipline, combined with an interest in developing hands-on expertise in security monitoring and detection engineering. You don't need to know every technology from day one: we're looking for technical aptitude, curiosity and sound judgement, together with the communication skills to work effectively with customers and colleagues in a secure environment.

• A technical background or relevant qualification, such as Computer Science, Software Engineering, Cyber Security or Digital Forensics.
• Knowledge or practical experience of SIEM technologies such as Elastic or Splunk.
• An understanding of cyber security monitoring, alerts, incident triage or investigation.
• A general understanding of IT technologies and operating environments, including Linux and/or other enterprise platforms.
• Strong analytical and problem-solving skills with the ability to assess information and determine when escalation is required.
• Strong written and verbal communication skills.
• The confidence to engage directly with customers and collaborate effectively within a technical team.
• An interest in cloud security, with Oracle Cloud experience advantageous and exposure to AWS, Azure or Google Cloud beneficial.
• Existing UK Security Clearance is advantageous; you must be willing and eligible to progress to a higher level of clearance where required.

You are invited to be an owner from day 1 as we work together to bring our Dream to life. That's why we call ourselves CGI Partners rather than employees. We benefit from our collective success and actively shape our company's strategy and direction. Your work creates value. You'll develop innovative solutions and build relationships with teammates and clients while accessing global capabilities to scale your ideas, embrace new opportunities, and benefit from expansive industry and technology expertise. You'll shape your career by joining a company built to grow and last. You'll be supported by leaders who care about your health and well-being and provide you with opportunities to deepen your skills and broaden your horizons. That same commitment to fairness extends to how we use technology. To support our recruitment team, AI tools may be used to help assess applications though they never replace human judgement. All hiring decisions remain entirely in the hands of our recruitment professionals. Come join our team-one of the largest IT and business consulting services firms in the world. Discover CGI London, England, United Kingdom > 1000 employees IT services We are a global business with 91,500 professionals across hundreds of locations worldwide, providing end-to-end IT and business process services that drive our clients' businesses.

Benefits:

• Insurance coverage
• Medical benefits
• Pension plan
• Member Assistant Programme
• Check4Cancer
• Flexible time off
• Share Purchase Plan
• Member discounts
• Dental benefits
• Vision benefits
• Profit Participation Plan
• Health and Well-being Programme

At CGI, you'll help strengthen the cyber resilience of critical UK programmes by building the data and detection capabilities that underpin an effective Security Operations Centre. Joining our Space, Defence and Intelligence business, you'll work with customers and experienced colleagues to onboard secure cloud environments, engineer security data pipelines and develop practical detection content. This is an opportunity to take ownership of meaningful technical work while expanding your skills across Oracle Cloud, Elastic and other major cloud platforms. You'll have the freedom to explore better ways of detecting threats, with the guidance and support of a collaborative team around you. Whether you're developing your cyber career or ready for your next challenge, you can make a tangible contribution to protecting important services. CGI was recognised in the Sunday Times Best Places to Work List 2025 and has been named a UK 'Best Employer' by the Financial Times. We offer a competitive salary, excellent pension, private healthcare, plus a share scheme (3.5% + 3.5% matching) which makes you a CGI Partner not just an employee.

This role requires full-time onsite working in Chippenham within a restricted working environment. Applicants who already hold Security Clearance are welcomed and will need to be willing and eligible to progress to a higher level of clearance where required. Additional payments are available for full-time onsite working and for working within the restricted environment.