SOC Analyst

Inforcer; Richmond; Hybrid; GBP 42,000 - 64,000; Full time

Benefits offered by this job

Steep learning curve

Real impact

Transparent culture

Global team

Team socials

Employee recognition

Job summary

inforcer is seeking a SOC Analyst to monitor, investigate and respond to security threats across our environment. You will be on the front line, reviewing alerts, conducting hands-on investigations and working 24/7 coverage as overtime is provided.

You will also help strengthen detections by improving playbooks, reducing noise and ensuring high-quality incident handling across endpoints, network and cloud platforms. Join a fast-growing startup with real impact and ongoing learning opportunities.

Qualifications

• Hands-on alert triage experience in a SOC, MSP, MSSP or internal security team.
• Working with KQL to query sign-in, audit and hunting data.
• Strong Microsoft 365 and Entra ID security knowledge.
• Practical understanding of MITRE ATT&CK and identity-led attack techniques.
• Sound judgement on evidence and conclusions.

Responsibilities

• Monitor in-house custom tooling for real-time alerts and suspicious activity.
• Triage, investigate and document security incidents following playbooks.
• Perform in-depth log analysis across the customer estate.
• Escalate incidents and collaborate with internal teams as needed.
• Support containment and remediation efforts.
• Contribute to improving detection content by identifying gaps and tuning opportunities.
• Participate in threat hunting and proactive investigations.
• Assist with onboarding and operationalizing new security tools and processes.
• Stay current with emerging threats and best practices.

Skills

Hands-on triage

KQL

Microsoft 365 security

Entra ID security

MITRE ATT&CK

Judgement

Written English

Job description

About Us

inforcer is one of the fastest growing technology organisations in the world and a leading provider of cutting‑edge cybersecurity and AI solutions to support to the SMB market. We provide MSPs (Managed Service Providers) with the fundamental technology they need to manage and secure Microsoft 365 at scale and deliver AI services. Our mission is to beinforcedin every MSP!

About the Role

We are seeking a SOC Analyst to play a critical role in monitoring, investigating, and responding to security threats across our environment. There are two key parts to the role.

Firstly, you will act as the front line of our security operations; reviewing alerts, identifying suspicious activity, and conducting hands‑on investigations using our SIEM, EDR, and threat intelligence tools. This is an operational role with real ownership, ideal for someone who thrives in a fast‑paced environment, enjoys digging into logs, and can bring clarity to complex behaviours across our network, endpoints, and cloud platforms. As part of this, you will take part in regular out‑of‑hours work, which is a natural component of a 24/7 security operation and compensated as overtime.

Secondly, you will help strengthen our detection and response capabilities by improving playbooks, enhancing alert quality, and contributing insights that increase our overall readiness. As our environment grows, you'll play a pivotal role in reducing noise, closing detection gaps, and ensuring incidents are handled quickly, consistently, and with high quality. Your work will directly support our ability to remain secure, resilient, and able to operate without interruption.

What you'll be doing

• Monitor our In-house Custom tooling for real‑time alerts and suspicious activity.
• Triage, investigate, and document security incidents following established playbooks.
• Perform In‑depth log analysis across our customer estate
• Escalate incidents as needed and collaborate with internal teams
• Support containment and remediation efforts
• Contribute to improving detection content by identifying gaps, false positives, and tuning opportunities.
• Participate in threat hunting exercises and proactive investigations into anomalous behaviour.
• Assist with onboarding and operationalizing new security tools and processes.
• Stay current with emerging threats, attack techniques, and security best practices.

What We Can Offer You

• Steep Learning curve: We believe people leave organisations when learning stops. We promise a steep and continuous learning curve to both challenge and develop our people. You are responsible for your own learning, but you'll be surrounded by exceptional people and strong enablement, if you choose to lean into it, in an environment where it's safe to make mistakes, try new things, and improve.
• Real impact: We operate in a high‑trust and autonomous environment where you can make a real impact and difference in your role and across the company.
• Transparency and Honesty: We believe honest and clear communication creates a highly collaborative culture. It gives you the "why" we make decisions and allows you to effectively make your own. We won't pull the wool over your eyes, we are a fast‑growing start‑up that comes with its own unique challenges, but we all work hard to solve them, together, as a team.
• A+ Global Team: Our people power every part of our business, and we look for individuals who bring genuine passion to their role and operate at their very best. A‑players thrive when surrounded by other A‑players. Our level of growth and rate of change can be hard work and challenging, but you'll be surrounded with exceptional people that are always happy to help.
• Regular Team Socials: We celebrate our team, our milestones, promotions and achievements with social events every month.
• Employee Recognition:Programs to recognise and reward our top contributors for their achievementsand efforts. We live our company values every day and reward those people who embody them.

Skills We Need for This Role

• Hands‑on alert triage experience in a SOC, MSP, MSSP or internal security team.
• Working KQL, you can query sign‑in, audit and hunting data to answer a question unaided.
• Strong Microsoft 365 and Entra ID security knowledge: authentication flows, conditional access, OAuth and app consent, mailbox and delegation permissions, and the audit trail behind each.
• Practical understanding of MITRE ATT&CK and identity‑led attack techniques against Microsoft 365.
• Sound judgement on when evidence supports a conclusion, and the confidence to say when it does not.
• Clear, concise written English for a technical audience, under time pressure

inforcer is an equal opportunity employer. We celebrate diversity and are committed to creating an inclusive environment for all employees.

Department Internal IT & Security Locations UK Office Remote status Hybrid