SOC Analyst - SC Cleared

Sanderson Government & Defence; Cheltenham; Remote; GBP 101,000 - 111,000; Part time

Job summary

Sanderson Government & Defence is seeking a SOC Analyst (SC Cleared) for a 3-month contract. This fully remote UK role focuses on developing and tuning Microsoft Sentinel detections, with strong KQL skills to deliver high-fidelity alerts for a live security operations centre.

You will work with security engineers and analysts, map detections to MITRE ATT&CK, manage data connectors, and produce clear technical documentation.

Qualifications

• Active SC Clearance.
• Sole British National.
• Minimum 3 years' experience in a SOC, Detection Engineering, SIEM Engineering or Cyber Security Engineering role.
• Strong hands-on experience with Microsoft Sentinel.
• Advanced knowledge of Kusto Query Language (KQL).
• Experience developing and maintaining Sentinel analytics rules and detection content.
• Understanding of the complete detection lifecycle, including development, testing, tuning and deployment.
• Experience working with Sentinel data connectors, Log Analytics, parsers and security telemetry.

Responsibilities

• Develop, test, deploy and maintain Microsoft Sentinel detection content
• Write, optimise and tune KQL queries for analytics rules, investigations and validation activities
• Convert security monitoring requirements into operationally effective detections
• Validate detections against available telemetry and data sources
• Tune and optimise existing analytics rules to improve alert fidelity and reduce false positives
• Assess data connectors, parsers, normalisation and ingestion requirements
• Investigate and resolve telemetry, parsing and alerting issues
• Support change control, release management and deployment processes
• Map detections to MITRE ATT&CK techniques and identify visibility gaps
• Work closely with SOC teams to ensure alerts are actionable and relevant
• Produce clear technical documentation, testing evidence and handover materials
• Leverage automation and scripting where appropriate to improve efficiency

Skills

SC Clearance

British National

Microsoft Sentinel

KQL

MITRE ATT&CK

PowerShell

Python

Git

Tools

SPL

SPL Query Language

Job description

SOC Analyst (SC Cleared)

£550-£600 per day (Inside IR35) | 3-Month Contract | Remote (UK) | Active SC Clearance Required

We're supporting a leading consultancy in the search for an experienced SOC Analyst to join their Cyber Security team on an initial 3-month contract. This is a fully remote opportunity for an analyst with strong Microsoft Sentinel and KQL expertise who can contribute immediately within a live Security Operations Centre (SOC) environment.

The successful candidate will play a key role in developing, tuning and maintaining security detections, ensuring the SOC receives high-fidelity, actionable alerts that support effective threat detection and response.

The Role

As a SOC Analyst, you will focus on the development, validation and optimisation of detection content within Microsoft Sentinel. Working alongside SOC analysts, security engineers and technical stakeholders, you will help improve threat visibility, reduce false positives and ensure monitoring requirements are translated into effective detections.

This role requires strong hands‑on experience with Microsoft Sentinel, security telemetry and Kusto Query Language (KQL), alongside the ability to work autonomously within a fast-paced cyber security environment.

Key Responsibilities

• Develop, test, deploy and maintain Microsoft Sentinel detection content
• Write, optimise and tune KQL queries for analytics rules, investigations and validation activities
• Convert security monitoring requirements into operationally effective detections
• Validate detections against available telemetry and data sources
• Tune and optimise existing analytics rules to improve alert fidelity and reduce false positives
• Assess data connectors, parsers, normalisation and ingestion requirements
• Investigate and resolve telemetry, parsing and alerting issues
• Support change control, release management and deployment processes
• Map detections to MITRE ATT&CK techniques and identify visibility gaps
• Work closely with SOC teams to ensure alerts are actionable and relevant
• Produce clear technical documentation, testing evidence and handover materials
• Leverage automation and scripting where appropriate to improve efficiency

Essential Skills & Experience

• Active SC Clearance
• Sole British National
• Minimum 3 years' experience within a SOC, Detection Engineering, SIEM Engineering or Cyber Security Engineering role
• Strong hands‑on experience with Microsoft Sentinel
• Advanced knowledge of Kusto Query Language (KQL)
• Experience developing and maintaining Sentinel analytics rules and detection content
• Understanding of the complete detection lifecycle, including development, testing, tuning and deployment
• Experience working with Sentinel data connectors, Log Analytics, parsers and security telemetry
• Strong troubleshooting skills across data ingestion, parsing and alert generation
• Knowledge of MITRE ATT&CK
• Understanding of identity, endpoint, network, cloud and infrastructure security monitoring
• Experience using Git repositories and controlled deployment processes
• Excellent communication and documentation skills
• Ability to work independently in a remote environment

Desirable Skills

• Splunk Enterprise Security experience
• Knowledge of SPL query language
• Microsoft Sentinel automation, Logic Apps or SOAR experience
• Detection-as-Code and CI/CD pipeline experience
• PowerShell or Python scripting skillsExperience supporting Threat Hunting or Incident Response activities

Reasonable Adjustments

Respect and equality are core values to us. We are proud of the diverse and inclusive community we have built, and we welcome applications from people of all backgrounds and perspectives. Our success is driven by our people, united by the spirit of partnership to deliver the best resourcing solutions for our clients.

If you need any help or adjustments during the recruitment process for any reason.