SOC Analyst

Tank Recruitment; City Of London; On-site; GBP 60,000 - 90,000; Full time

Job summary

Tank Recruitment is seeking an experienced Incident Response Analyst to support detection, triage, investigation, containment and resolution of cyber security incidents across a complex enterprise environment. You will monitor alerts from SIEM, EDR/XDR, and cloud services; triage incidents, assess impact, coordinate containment and recovery; conduct post-incident reviews and write playbooks.

The role requires hands-on experience with SIEM/EDR, strong analytical skills and the ability to

Qualifications

• Experience in cyber security incident response in a SOC or security operations environment.
• Hands-on experience with SIEM and EDR/XDR technologies.
• Knowledge of incident response lifecycle and standard security frameworks.

Responsibilities

• Monitor and investigate alerts from SIEM, EDR/XDR, identity, email, cloud and network security technologies.
• Triage incidents, assess severity and business impact, and coordinate containment, eradication and recovery.
• Investigate phishing, malware, account compromise, data loss, unauthorised access and suspicious network activity.
• Collect, preserve and analyse endpoint, server, identity, network, email and cloud artefacts.
• Analyse logs, packet captures, forensic images and security telemetry to establish scope and attacker activity.
• Identify IOCs, attacker behaviours, TTPs and map findings to MITRE ATT&CK where appropriate.
• Develop and execute threat hunts and contribute to detection rule, monitoring and logging improvements.
• Maintain incident records, investigation timelines, evidence and post-incident reports.
• Develop and maintain incident response playbooks, procedures and communication processes.
• Conduct post-incident reviews, root- cause analysis and lessons-learned activities.
• Provide clear technical and management updates to senior stakeholders.

Skills

Incident response

Security monitoring

Analysis

Communication

Analytical skills

Education

Cyber security degree

Tools

SIEM

EDR/XDR

Windows logs

Linux logs

Job description

Incident Response Analyst

We are seeking an experienced Incident Response Analyst to support the detection, triage, investigation, containment and resolution of cyber security incidents across a complex enterprise environment.

Key Responsibilities

• Monitor and investigate alerts from SIEM, EDR/XDR, identity, email, cloud and network security technologies.

• Triage incidents, assess severity and business impact, and coordinate containment, eradication and recovery.

• Investigate phishing, malware, account compromise, data loss, unauthorised access and suspicious network activity.

• Collect, preserve and analyse endpoint, server, identity, network, email and cloud artefacts.

• Analyse logs, packet captures, forensic images and security telemetry to establish scope, root cause and attacker activity.

• Identify IOCs, attacker behaviours, TTPs and map findings to MITRE ATT&CK where appropriate.

• Develop and execute threat hunts and contribute to detection rule, monitoring and logging improvements.

• Maintain incident records, investigation timelines, evidence and post-incident reports.

• Develop and maintain incident response playbooks, procedures and communication processes.

• Conduct post-incident reviews, root-cause analysis and lessons-learned activities.

• Provide clear technical and management updates to senior stakeholders.

Essential Skills & Experience

• Practical experience in cyber security incident response, security monitoring or a SOC environment.

• Hands-on experience with SIEM and EDR/XDR technologies.

• Experience investigating Windows and Linux systems, authentication activity, security logs and network traffic.

• Strong understanding of the incident response lifecycle.

• Knowledge of MITRE ATT&CK, Cyber Kill Chain and NIST.

• Good understanding of enterprise networking, IAM, cloud, email and endpoint security.

• Experience with digital forensics and evidence handling.

• Strong communication, investigation and analytical skills.

Desirable

• Banking, financial services or other regulated-sector experience.

• Microsoft Sentinel, Defender XDR, Defender for Identity or Defender for Cloud.

• KQL, PowerShell, Python or similar scripting/automation.

• Threat hunting, malware analysis and detection engineering.

• Azure and Microsoft 365 investigation experience.

• EnCase, FTK, Velociraptor, Volatility or Wireshark.

• Certifications such as GCIH, GCIA, GCFA, GNFA, SC-200, CySA+ or CISSP.

Qualifications

Relevant cyber security experience, degree or equivalent practical experience. Knowledge of NIST, CIS Controls and recognised information security standards.