SOC / Cyber Threat Detection Analyst – SANS/GIAC

Cyber UK; Wokingham; On-site; GBP 45,000 - 70,000; Full time

Benefits offered by this job

Excellent benefits and training

Job summary

Cyber UK in Wokingham is seeking a Cyber Threat Detection Analyst to engage in proactive threat hunting and high-fidelity threat detection. This role requires hands-on experience with SIEM platforms to analyze and hunt for malicious activity. The ideal candidate will have around five years of experience in cyber defence environments, operational understanding of MITRE ATT&CK, and be able to collaborate efficiently with various teams. Security certifications like SANS/GIAC are highly beneficial.

Qualifications

• Around five years of hands-on experience in cyber defence or SOC environments.
• Strong hands-on experience using SIEM platforms.
• Operational understanding of MITRE ATT&CK and attacker techniques.

Responsibilities

• Conduct proactive threat hunting across telemetry.
• Develop hypotheses aligned to MITRE ATT&CK.
• Write and optimise SIEM queries.
• Lead investigations from detection to impact assessment.
• Support incident management and response activities.

Skills

Threat hunting

Cyber threat detection

SIEM platforms experience (Microsoft Sentinel, Splunk, Elastic Security)

Understanding of MITRE ATT&CK

Experience with IOCs and threat intelligence

Knowledge of networking fundamentals

Experience with EDR/XDR technologies

Analytical mindset

Education

SANS/GIAC certifications

OSCP or equivalent

Tools

Microsoft Sentinel

Splunk

Elastic Security/Kibana

Microsoft Defender

CrowdStrike

Job description

SOC / Cyber Threat Detection Analyst – SANS/GIAC Cyber Threat Detection Analyst

Location: Wokingham, Berkshire (On-site)
Salary: Competitive (dependent on experience) + excellent benefits & training
Security Clearance: Ideally SC Cleared or eligible for SC

Role Overview

As a Cyber Threat Detection Analyst, you will play a hands‑on role within an advanced cyber defence function, focused on proactive threat hunting, adversary behaviour analysis, and high‑fidelity threat detection across enterprise environments. This role goes beyond reactive alert handling. You will actively hunt for malicious activity using telemetry, SIEM data, and threat intelligence, develop hypotheses based on MITRE ATT&CK Tactics, Techniques, and Procedures (TTPs), and support incident management and response activities when threats are identified. We are open to experienced SOC Analysts where threat hunting, investigations, and proactive detection have formed a significant part of their role, and who are looking to further develop in a more hunting‑led environment. This position is well suited to analysts who enjoy thinking like an attacker, have worked alongside or supported red team or purple team activities, and want to deepen their expertise in threat detection and detection engineering.

Skills & Experience We’re Seeking

• Experience in threat hunting, cyber threat detection, SOC, blue team, or cyber defence environments, with ideally around five years hands‑on experience.
• Strong hands‑on experience using SIEM platforms, including: Microsoft Sentinel (KQL), Splunk (SPL), Elastic Security/Kibana (KQL, ESQL).
• Practical and operational understanding of MITRE ATT&CK, attacker techniques, and adversary tradecraft.
• Experience working with Indicators of Compromise (IOCs) and threat intelligence feeds.
• Solid experience across the security event life cycle, including detection, investigation, and incident management.
• Hands‑on experience with EDR/XDR technologies such as Microsoft Defender, CrowdStrike, SentinelOne, or Carbon Black.
• Strong knowledge of networking fundamentals (TCP/IP, DNS, HTTP/S, Firewalls, VPNs, Proxy technologies).
• Experience analysing telemetry from Windows, Linux, identity, endpoint, and network sources.
• Strong analytical mindset with the ability to clearly communicate findings, impact, and risk.

Key Responsibilities

• Conduct proactive threat hunting activities across log, endpoint, and network telemetry to identify suspicious, stealthy, or previously unknown threats.
• Develop and execute hunt hypotheses aligned to MITRE ATT&CK TTPs, adversary behaviours, and emerging threat intelligence.
• Write, refine, and optimise SIEM queries using KQL, SPL, Elastic/ESQL, and Kibana Query Language.
• Perform IOC analysis, enrichment, and validation, integrating internal and external threat intelligence sources.
• Lead investigations from initial detection through scoping, root cause analysis, and impact assessment.
• Support incident management and incident response activities, including containment, remediation, escalation, and lessons learned.
• Collaborate closely with SOC teams, incident responders, red teams, and purple teams to validate detections and improve defensive coverage.
• Contribute to detection logic improvements, use‑case development, and continuous enhancement of hunting methodologies.
• Produce clear investigation write‑ups, timelines, and recommendations for technical and non‑technical stakeholders.

Security Certifications (Highly Beneficial)

• SANS/GIAC certifications, including but not limited to: GCIH – Incident Handler, GCIA – Intrusion Analyst, GCED – Enterprise Defender, GCTI – Cyber Threat Intelligence, GMON – Continuous Monitoring, GDAT – Defending Advanced Threats, GCAT – Advanced Threat Intelligence.
• OSCP or equivalent offensive security qualifications.
• Crest certifications, such as: Crest Practitioner Intrusion Analyst (CPIA), Crest Registered Intrusion Analyst (CRIA), Crest Certified Threat Intelligence Analyst (CCTIA), Crest Certified Blue Team Professional (CCBTP).
• Microsoft SC-200 or related detection and response certifications.
• Other recognised cyber security or threat intelligence credentials.