SOC Analyst Level 2

Focus Group; Manchester; Hybrid; GBP 35,000 - 40,000; Full time

Benefits offered by this job

Holiday allowance

Hybrid working

Parental leave

Volunteer day

Company benefits

Job summary

Focus Group is seeking a SOC Analyst Level 2 to join our Security Operations Centre. You’ll investigate complex incidents, act as a technical escalation point, and help improve detection capabilities across key platforms.

The role supports hybrid/remote work, with a base in Manchester and a permanent contract. You will collaborate with customers and internal teams to strengthen security outcomes and reduce risk.

Qualifications

• Minimum 2 years' experience in a SOC/MSSP or cyber security operations environment.
• Hands-on experience investigating and triaging security alerts.
• Experience using RocketCyber, SaaS Alerts, or Bitdefender GravityZone EDR.

Responsibilities

• Investigate and validate security alerts escalated from Level 1 analysts across RocketCyber, SaaS Alerts and Bitdefender GravityZone EDR.
• Analyse endpoint, behavioural, and cloud identity events to identify malicious activity and signs of compromise.
• Perform root cause analysis on security incidents including phishing attacks and MFA-related threats.
• Coordinate response activities with internal engineering teams and customer stakeholders.
• Mentor Level 1 SOC Analysts and contribute to playbooks and detection improvements.

Skills

SOC experience

Incident investigation

Analytical thinking

Mentoring junior analysts

Communication skills

Tools

RocketCyber

SaaS Alerts

Bitdefender GravityZone EDR

Azure/Microsoft 365 security tooling

Job description

SOC Analyst Level 2

Join Focus Group's Growing Cyber Security Team

Department: Technical Operations

Location: Manchester

Compensation: £35,000 - £40,000 / year

Description

SOC Analyst Level 2

Location: Hybrid / Remote

Salary: Competitive

Contract: Permanent

Join Focus Group is looking for an experienced SOC Analyst Level 2 to join our expanding Security Operations Centre (SOC). This is an exciting opportunity for a cyber security professional looking to take the next step in their career, working with a wide range of customers and technologies while helping to strengthen and scale our managed security services.

As a key member of the SOC team, you'll investigate complex security incidents, act as a technical escalation point for junior analysts, and contribute to the continuous improvement of our detection capabilities, operational processes, and customer security outcomes.

Working across leading security platforms including RocketCyber, SaaS Alerts, and Bitdefender EDR, you'll play a critical role in identifying threats, coordinating responses, and helping to protect our customers from an ever-evolving cyber threat landscape.

Key Responsibilities

The Role

As a SOC Analyst Level 2, you'll be responsible for investigating and validating escalated alerts, correlating activity across multiple security platforms, and driving effective incident response activities. You'll also mentor Level 1 SOC Analysts, contribute to playbook development, improve detection logic, and support the ongoing evolution of our Security Operations Centre.

This role offers excellent progression opportunities for those looking to develop into Senior SOC, Detection Engineering, Threat Intelligence, or Incident Response roles.

Key Responsibilities

• Investigate and validate security alerts escalated from Level 1 analysts across RocketCyber, SaaS Alerts, and Bitdefender EDR platforms.
• Analyse endpoint, behavioural, and cloud identity events to identify malicious activity and signs of compromise.
• Perform root cause analysis on security incidents including phishing attacks, suspicious inbox rules, account compromise, and MFA-related threats.
• Correlate intelligence across multiple platforms to understand business impact and determine appropriate response actions.
• Coordinate response activities with internal engineering teams and customer stakeholders.
• Ensure investigations are fully documented with high-quality case notes and clear escalation paths.
• Support incident reviews and contribute to improvements in playbooks, detection logic, and tooling.
• Act as a technical escalation point and mentor for Level 1 SOC Analysts.
• Assist with customer onboarding into the SOC monitoring stack and support service alignment activities.
• Identify opportunities to improve alert quality, reduce false positives, and enhance SOC efficiency.
• Stay up to date with emerging cyber threats, attack techniques, and industry best practices.

Skills, Knowledge & Expertise

What We’re Looking For

Essential Skills & Experience

• Minimum 2 years' experience within a SOC, MSSP, or cyber security operations environment.
• Hands-on experience investigating and triaging security alerts.
• Experience using security platforms such as RocketCyber, SaaS Alerts, or Bitdefender GravityZone EDR.
• Strong understanding of Microsoft 365 security threats, including suspicious logins, MFA attacks, and identity-based compromises.
• Knowledge of attacker techniques and the MITRE ATT&CK framework.
• Strong analytical and investigative skills with the ability to perform root cause analysis.
• Experience correlating security data across multiple sources and platforms.
• Excellent written and verbal communication skills.
• Ability to explain technical information to both technical and non-technical stakeholders.
• A collaborative mindset with a passion for mentoring and supporting colleagues.
• Strong attention to detail and commitment to high-quality documentation.
• Comfortable working independently within a remote-first environment.

Desirable Skills

• Industry certifications such as:
  • Microsoft SC-200
  • CompTIA Security+
  • GCIH (GIAC Certified Incident Handler)
  • BTL1 (Blue Team Level 1)
• Experience tuning detection rules and security alerts.
• Exposure to vulnerability management and customer security reporting.
• Experience with scripting, APIs, or automation tools.
• Understanding of threat intelligence and indicators of compromise (IOCs).
• Knowledge of email security technologies and attack vectors.
• Experience analysing logs across multiple security platforms.
• Familiarity with Azure and Microsoft 365 security tooling.

Job Benefits

• Holiday Allowance - 24 days + bank holidays + birthday leave.
• Hybrid working options - performance depending.
• Enhanced maternity, paternity and adoption leave.
• Paid volunteering day * regular charity events.
• Wider company benefits across health, financial wellbeing, Pension etc.

Internal job reference: Senior Associate

Focus Group data privacy notice:- https://focusgroup.co.uk/information/privacy-notice/