SOC Detection Engineer - Cloud Security & Threat Detection

Free-Work UK; Chippenham; On-site; GBP 32,000 - 46,000; Full time

Benefits offered by this job

Share scheme (3.5% + 3.5% matching)

Excellent pension

Private healthcare

Job summary

CGI is seeking a Security Operations Centre professional to join the Data and Detection Engineering team in Chippenham. You will help onboard customers, design data ingestion into Elastic, and develop detection logic for SOC triage while expanding exposure to Oracle Cloud and other cloud platforms.

You’ll contribute to day-to-day security monitoring, incident investigation, and continuous improvement while working with experienced cyber professionals in a secure environment.

Qualifications

• Technical background in cyber security or related discipline.
• Knowledge of SIEM technologies such as Elastic or Splunk.
• Understanding of cyber security monitoring, alerts, incident triage or investigation.
• General IT knowledge including Linux and enterprise platforms.
• Strong analytical and problem‑solving skills.
• Strong written and verbal communication skills.
• Willingness to engage with customers and collaborate in a technical team.
• Interest in cloud security with Oracle Cloud experience advantageous and exposure to AWS/Azure/Google Cloud beneficial.
• Existing UK Security Clearance is advantageous; willing to progress to higher clearance if required.

Responsibilities

• Engineer & Deliver: Design and support security data ingestion pipelines into Elastic for newly onboarded customers.
• Develop & Detect: Draft detection rules against defined cyber security use cases and create SOC triage guides.
• Engage & Onboard: Liaise with customers to gather technical information for SOC onboarding.
• Monitor & Triage: Review security alerts from SIEM and other systems, assess severity and impact.
• Investigate & Escalate: Support incident investigations and recommend containment or escalation actions.
• Analyse & Respond: Monitor client environments, investigate alerts and respond to incidents within SLAs.
• Learn & Improve: Research emerging threats and security practices, sharing knowledge with colleagues.
• Support & Assure: Assist with investigations, exercises, testing, changes and first-line support.
• Operate & Automate: Ensure scheduled jobs and automated processes run reliably.

Skills

Cyber security

SIEM

Cloud security

Data ingestion

Detection engineering

Customer engagement

Education

Computer Science

Software Engineering

Cyber Security

Digital Forensics

Tools

Elastic

Splunk

Oracle Cloud

AWS

Azure

Google Cloud

Job description

CGI is seeking a Security Operations Centre professional to join the Data and Detection Engineering team in Chippenham. You will help onboard customers, design data ingestion into Elastic, and develop detection logic for SOC triage while expanding exposure to Oracle Cloud and other cloud platforms.

You’ll contribute to day-to-day security monitoring, incident investigation, and continuous improvement while working with experienced cyber professionals in a secure environment.